CVE-2022-42036
EPSS 0.47%
Description
The d8s-urls package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-csv package. The affected version is 0.1.0.
How to fix CVE-2022-42036
No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.
- PyPI/d8s-urls—no fix listed
- PyPI/democritus-csv—no fix listed
Is CVE-2022-42036 being exploited?
Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0
- from 0