CVE-2022-28470

Description

marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.

How to fix CVE-2022-28470

To remediate CVE-2022-28470, upgrade the affected package to a fixed version below.

• PyPI/marcador—upgrade to 0.14 or later
• PyPI/marcador—upgrade to 0.14 or later

Is CVE-2022-28470 being exploited?

Low — EPSS is 0.9%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 0.14
• >= 0.1, < 0.14

CVSS scores

References (9)

• ADVISORYgithub.com/advisories/GHSA-57qv-h9m7-jxfg
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-28470
• PATCHgithub.com/joajfreitas/marcador
• PATCHpypi.org/project/marcador/
• WEBpypi.doubanio.com/simple/request