CVE-2023-5752
LowSummary
A vulnerability in pip prior to version 23.3 allows injecting arbitrary configuration options into the 'hg clone' call when installing a package from a Mercurial VCS URL (hg+...). An attacker can control Mercurial configuration, modifying how and what is cloned.
Risk Assessment
The risk involves potential remote code execution or modification of the package installation process, which could lead to system integrity compromise or data theft.
Recommendation
Immediately upgrade pip to version 23.3 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which