{"action":"Upgrade libvcs to 0.11.1 or later.","affected":[{"fixed":"0.11.1","introduced":"0"}],"component":"libvcs","cve_ids":["CVE-2022-21187"],"ecosystem":"PyPI","epss":0.03624,"exploited":false,"fixed_versions":["0.11.1"],"ghsa_id":"GHSA-mv2w-4jqc-6fg4","id":"tcs_01M5KGG8T750BQQSQ1BBYWQ0HW","modified_at":"2026-06-29T12:26:21.761856147Z","published_at":"2022-03-14T18:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-163","https://github.com/vcs-python/libvcs/pull/306","https://github.com/vcs-python/libvcs/blob/v0.11.1/CHANGES%23libvcs-0111-2022-03-12","https://snyk.io/vuln/SNYK-PYTHON-LIBVCS-2421204"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-163","url":"https://osv.dev/vulnerability/PYSEC-2022-163"}],"summary":"The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command."}