CVE-2023-5752

When installing a package from a Mercurial VCS URL (ie "pip installhg+...") with pip prior to v23.3, the specified Mercurial revision couldbe used to inject arbitrary configuration options to the "hg clone"call (ie "--config"). Controlling the Mercurial configuration can modifyhow and which reposit...