CVE-2022-41386
EPSS 0.47%
Description
The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.
How to fix CVE-2022-41386
No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.
- PyPI/d8s-utility—no fix listed
- PyPI/democritus-urls—no fix listed
Is CVE-2022-41386 being exploited?
Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0
- from 0