CVE-2023-5752 (published 2023-10-24T20:56:05.469Z)
When installing a package from a Mercurial VCS URL  (ie "pip install 
hg+...") with pip prior to v23.3, the specified Mercurial revision could
 be used to inject arbitrary configuration options to the "hg clone" 
call (ie "--config"). Controlling the Mercurial configuration can modify
 how and which repository is installed. This vulnerability does not 
affect users who aren't installing from Mercurial.

Affected products: Vendor: Pip maintainers
Product: pip
Versions: 23.3