{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"keep","cve_ids":["CVE-2022-30877"],"ecosystem":"PyPI","epss":0.02631,"exploited":false,"fixed_versions":[],"id":"tcs_01M5KGHMWT4PKHB1SMGP55108X","modified_at":"2025-10-09T08:24:04.785178Z","published_at":"2022-06-08T18:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-43056","https://github.com/OrkoHunter/keep/issues/85","https://pypi.org/project/keep","http://pypi.doubanio.com/simple/request"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2022-43056","url":"https://osv.dev/vulnerability/PYSEC-2022-43056"}],"summary":"The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2."}