{"action":"Upgrade pip to 23.3 or later.","affected":[{"fixed":"23.3","introduced":"0"}],"component":"pip","cve_ids":["CVE-2023-5752"],"ecosystem":"PyPI","epss":0.00502,"exploited":false,"fixed_versions":["23.3"],"ghsa_id":"GHSA-mq26-g339-26xf","id":"tcs_01M5KGK0EK0QPXE4CKW3PGWG4P","modified_at":"2026-06-10T17:01:27.606909654Z","published_at":"2023-10-25T18:17:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-228","https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/","https://github.com/pypa/pip/pull/12306","https://github.com/advisories/GHSA-mq26-g339-26xf"],"severity":{"label":"low","score":3.3},"sources":[{"source":"osv","source_id":"PYSEC-2023-228","url":"https://osv.dev/vulnerability/PYSEC-2023-228"}],"summary":"When installing a package from a Mercurial VCS URL (ie \"pip install"}