CVE-2023-5752

Medium

Advisory

Published 25 Oct 2023In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.005; 40th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 756; of 17,787 indexed, latest versions
Container images: 786; deployed by those charts
Fix available: 1 of 2; affected packages

Command Injection in pip when used with Mercurial

Carried by container images the latest versions of 756 of 17,787 indexed charts deploy, on 786 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+50 more	23.3	786
python-pipdeb	23.0.1+dfsg-1	no fix listed	25

OSV records: GHSA-mq26-g339-26xf DEBIAN-CVE-2023-5752
Also known as: PYSEC-2023-228

Charts affected

756 by stars

Chart

Latest

Affected images

Radar Score

xkopsxkops

0.1.0

3 of 5 See more

xkops xkops 0.1.0

3 of the 5 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	pip@23.0.1	23.3
hamzaarshad10/querypodpy :1.7	154f38e8668e	pip@23.0.1	23.3
murtazashah46/helmfile :latest	4d11726cf803	pip@23.0.1	23.3

Open the chart page →

13,197

zahori-serverzahori

1.0.1

1 of 2 See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
flyway/flyway :9.14.1-alpine	80f12c80502b	pip@22.3.1	23.3

Open the chart page →

5,847

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	pip@9.0.3	23.3

Open the chart page →

6,016

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	pip@22.3.1	23.3

Open the chart page →

1,838

alertmanager-matrix-forwarderzloi-space

1.0.1

1 of 2 See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	pip@21.2.4	23.3

Open the chart page →

3,118

grafana-matrix-forwarderzloi-space

1.0.0

1 of 2 See more

grafana-matrix-forwarder zloi-space 1.0.0

1 of the 2 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	pip@21.2.4	23.3

Open the chart page →

1,636

Container images carrying it

786 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
openelevation/open-elevation :latest	82fb21612e86	pip@20.0.2	23.3	1
openemr/openemr :6.1.0	89eaa6d9a4e3	pip@22.0.4	23.3	1
openspeedtest/latest :v2.0.0	d4d62f4b7d85	pip@22.3.1	23.3	1
openstackhelm/heat :wallaby-ubuntu_focal	f728510bab3c	pip@21.2.3	23.3	1
openstackhelm/keystone :wallaby-ubuntu_focal	e07d75953d2e	pip@21.2.3	23.3	1
openwhisk/kafkaprovider :2.1.0	63dc3d2a0904	pip@19.3.1	23.3	1
openwhisk/ow-utils :1.0.0	c80dba0de3aa	pip@9.0.1	23.3	1
openzaak/open-notificaties :1.3.0	2e65313b9b10	pip@22.0.4	23.3	1
openzaak/open-zaak :1.6.0	2ca2ea6e0ae9	pip@22.0.4	23.3	1
oxheadalpha/tezos-k8s-utils :5.3.4	d9faed45bf1c	pip@21.2.4	23.3	1
pangeo/base-notebook :2024.01.15	5fbe688a4f80	pip@23.2.1	23.3	1
pecan/monitor :1.7.2	73b2074f3fec	pip@20.2.3	23.3	1
percona/pmm-server :3.9.1	003f9c25f842	pip@21.3.1	23.3	1
phan2410/dummy-service :0.0.8	9c6ed6de26ca	pip@23.0.1 python-pip@23.0.1+dfsg-1	23.3 no fix listed	1
phntom/email-manager :0.1.22	d8e2a9f2f085	pip@22.3.1	23.3	1
phntom/external-dns-host-network :0.0.12	3adadbac8443	pip@22.0.4	23.3	1
phntom/postgresql-backup-s3 :1.0.22	49b6488f618b	pip@22.3.1	23.3	1
phntom/stocks-nasdaq-crawler :0.0.28	d2b844700b57	pip@20.2.3	23.3	1
phsmith/rundeck-exporter :2.6.1	0265a7616ae8	pip@22.3.1	23.3	1
pnnlmiscscripts/gitlab-runner-operator :0.1.3-1	155131891741	pip@9.0.3	23.3	1
pnnlmiscscripts/tenant-namespace-operator :0.1.24-1	8af4b7551d40	pip@23.1.2	23.3	1
pococze/python-hello-elos :2.0.0	7a1aab425e51	pip@23.0.1	23.3	1
prompve/prometheus-pve-exporter :2.0.1	ff6749eb03b0	pip@20.1.1	23.3	1
pryorda/vmware_exporter :v0.18.4	79925e63e59f	pip@22.0.4	23.3	1
pryorda/vmware_exporter :v0.18.3	e0f5ba8b7856	pip@22.0.4	23.3	1
pschiffe/pdns-admin :0.4.1	37ebba8c2b8f	pip@21.3.1	23.3	1
pypiserver/pypiserver :v1.4.2	c9250d3c418d	pip@20.2.3	23.3	1
pypiserver/pypiserver :v2.4.1	e935e19433ef	pip@23.0.1	23.3	1
pysga1996/python-redis-web :latest	fdeec30ad482	pip@22.0.4	23.3	1
rdavidoff/twitch-channel-points-miner-v2 :1.8.6	7ae4c5135771	pip@23.2.1	23.3	1
redash/redash :25.8.0	00d813437db5	pip@23.0.1	23.3	1
redash/redash :10.0.0.b50363	9392753c0376	pip@20.2.4	23.3	1
redislabs/redisearch :2.4.14	33561794c5c8	pip@22.2.2	23.3	1
redislabs/redisinsight :1.14.0	b03ab1426d0d	pip@23.1.2	23.3	1
reportportal/service-auto-analyzer :5.7.2	95ada4a216ce	pip@22.0.4	23.3	1
reportportal/service-metrics-gatherer :1.1.20	2a0e6dc11161	pip@22.1.2	23.3	1
rezachalak/bzen-mongo :1.0.0	34f694325191	pip@20.0.2	23.3	1
rhasspy/wyoming-piper :2.3.1	69b7f797ae3a	pip@23.0.1 python-pip@23.0.1+dfsg-1	23.3 no fix listed	1
rhasspy/wyoming-speech-to-phrase :1.4.3	e532f0dbc6b2	pip@23.0.1 python-pip@23.0.1+dfsg-1	23.3 no fix listed	1
rhasspy/wyoming-whisper :3.5.0	308b7959a925	pip@23.0.1 python-pip@23.0.1+dfsg-1	23.3 no fix listed	1
rhasspy/wyoming-whisper :1.0.0	80b99ddeef6c	pip@20.3.4	23.3	1
richardchesterwood/k8s-fleetman-webapp-angular :release2	ed7d720878ac	pip@9.0.1	23.3	1
roadiehq/community-backstage-image :latest	ef355bf5b639	pip@19.2.3	23.3	1
robmarkcole/deepstack-ui :latest	410275726459	pip@21.2.4	23.3	1
robotshop/rs-payment :latest	774b52c6180d	pip@21.2.4	23.3	1
runx1/opta-agent :latest	0ca3867d3200	pip@22.0.4	23.3	1
saltstack/salt :3006.3	e9c7906b7a5c	pip@22.0.4	23.3	1
samueldg/snappass :latest	3987195edbe6	pip@19.3.1	23.3	1
santisbon/evwatcher :latest	c4e994ca4540	pip@23.0.1 python-pip@23.0.1+dfsg-1	23.3 no fix listed	1
santisbon/evworker :latest	e807283f8d69	pip@23.0.1 python-pip@23.0.1+dfsg-1	23.3 no fix listed	1