PYSEC-2026-563 Command injection in libvcs and vcspull

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

Command injection in libvcs and vcspull

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

PT-2026-53632

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update repo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

EUVD-2022-0137

Malicious code in bioql PyPI...

Command Injection

libvcs is vulnerable to command injection. An attacker can inject and execute malicious hg clone commands through URLs in the obtain function of hg.py...

Command injection in libvcs and vcspull

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

GHSA-MV2W-4JQC-6FG4 Command injection in libvcs and vcspull

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

vcspull (>=1.5.0a1, <=1.8.1) potentially affected by CVE-2022-21187 via libvcs (>=0.4.4, <=0.10.1)

libvcs PYPI version =0.4.4, =1.5.0a1, =1.8.1 Source cves: CVE-2022-21187 Source advisory: OSV:GHSA-MV2W-4JQC-6FG4...

vcspull (>=1.5.0a1, <=1.8.1) potentially affected by CVE-2022-21187 via libvcs (>=0.4.4, <=0.10.1)

libvcs PYPI version =0.4.4, =1.5.0a1, =1.8.1 Source cves: CVE-2022-21187 Source advisory: GHSA-MV2W-4JQC-6FG4...

CVE-2022-21187

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

PYSEC-2022-163

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

vcspull (>=1.5.0a1, <=1.8.1) potentially affected by CVE-2022-21187 via libvcs (>=0.4.4, <=0.10.1)

libvcs PYPI version =0.4.4, =1.5.0a1, =1.8.1 Source cves: CVE-2022-21187 Source advisory: OSV:PYSEC-2022-163...

PYSEC-2022-163

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

Command injection

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

CVE-2022-21187 Command Injection

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

CVE-2022-21187

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

vcspull (>=1.5.0a1, <=1.8.1) potentially affected by CVE-2022-21187 via libvcs (>=0.4.4, <=0.10.1)

libvcs PYPI version =0.4.4, =1.5.0a1, =1.8.1 Source cves: CVE-2022-21187 Source advisory: MEND:CVE-2022-21187...

CVE-2022-21187

The CVE-2022-21187 issue affects the libvcs package prior to version 0.11.1. The vulnerability arises in the update_repo path (when using Mercurial via hg), where the url parameter is passed to the hg clone command, enabling command injection and potential arbitrary command execution. Available c...

CVE-2022-21187 Command Injection

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...

CVE-2022-21187

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the updaterepo function when using hg, the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution...