Command Injection in pip when used with Mercurial
Date: 2023-10
Affected: pip/pip
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2023-5752
CWE: CWE-77
CVSS: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

When installing a package from a Mercurial VCS URL, e.g. `pip install hg+...`, with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the `hg clone` call (e.g. `--config`). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.


Mitigations:

Architectural layers (MAESTRO):