CVE-2023-5752

Medium

Advisory

Published 25 Oct 2023In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.005; 40th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 756; of 17,787 indexed, latest versions
Container images: 786; deployed by those charts
Fix available: 1 of 2; affected packages

Command Injection in pip when used with Mercurial

Carried by container images the latest versions of 756 of 17,787 indexed charts deploy, on 786 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+50 more	23.3	786
python-pipdeb	23.0.1+dfsg-1	no fix listed	25

OSV records: GHSA-mq26-g339-26xf DEBIAN-CVE-2023-5752
Also known as: PYSEC-2023-228

Charts affected

756 by stars

Chart

Latest

Affected images

Radar Score

xkopsxkops

0.1.0

3 of 5 See more

xkops xkops 0.1.0

3 of the 5 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	pip@23.0.1	23.3
hamzaarshad10/querypodpy :1.7	154f38e8668e	pip@23.0.1	23.3
murtazashah46/helmfile :latest	4d11726cf803	pip@23.0.1	23.3

Open the chart page →

13,197

zahori-serverzahori

1.0.1

1 of 2 See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
flyway/flyway :9.14.1-alpine	80f12c80502b	pip@22.3.1	23.3

Open the chart page →

5,847

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	pip@9.0.3	23.3

Open the chart page →

6,016

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	pip@22.3.1	23.3

Open the chart page →

1,838

alertmanager-matrix-forwarderzloi-space

1.0.1

1 of 2 See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	pip@21.2.4	23.3

Open the chart page →

3,118

grafana-matrix-forwarderzloi-space

1.0.0

1 of 2 See more

grafana-matrix-forwarder zloi-space 1.0.0

1 of the 2 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	pip@21.2.4	23.3

Open the chart page →

1,636

Container images carrying it

786 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/ibmgaragecloud/cli-tools :v0.15	9663f06adcb1	pip@22.0.4	23.3	1
quay.io/jupyterhub/k8s-hub :3.2.1	2528c6e57587	pip@23.2.1	23.3	1
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	pip@9.0.3	23.3	1
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	pip@9.0.3	23.3	1
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	pip@9.0.3	23.3	1
quay.io/keycloak/keycloak-operator :20.0.2	b1710745fa64	pip@9.0.3	23.3	1
quay.io/kiwigrid/k8s-sidecar :1.10.7	18feb3906286	pip@21.0.1	23.3	1
quay.io/kiwigrid/k8s-sidecar :1.15.6	1f025ae37b7b	pip@21.2.4	23.3	1
quay.io/kiwigrid/k8s-sidecar :1.21.0	710e23b489c5	pip@22.3.1	23.3	1
quay.io/kiwigrid/k8s-sidecar :1.15.1	a25886092fa4	pip@21.2.4	23.3	1
quay.io/kiwigrid/k8s-sidecar :1.25.2	cb4c638ffb1f	pip@23.2.1	23.3	1
quay.io/maximilianopizarro/neuroface-backend :v1.4.1	3194d46df0f9	pip@22.3.1	23.3	1
quay.io/maximilianopizarro/neuroface-backend :latest	cba71dc08c8a	pip@22.3.1	23.3	1
quay.io/mongodb/farm-intro-backend :0.1	1a9ce0b8fbd4	pip@21.2.4	23.3	1
quay.io/netscaler/netscaler-cpx :14.1-66.59	8602e36d4564	pip@22.0.4	23.3	1
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	pip@22.0.4	23.3	1
quay.io/ongres/kubectl :v1.25.16-build-6.53	04dada9e4503	pip@23.2.1	23.3	1
quay.io/openshift/origin-cli :4.6	6722d5041b47	pip@9.0.3	23.3	1
quay.io/openshift/origin-console :4.10.0	0bbe8b451fa3	pip@9.0.3	23.3	1
quay.io/openshift/origin-jenkins-agent-base :latest	c241c971aef8	pip@9.0.3	23.3	1
quay.io/opsmxpublic/awsgit :v2-openssh	0d21ba756f44	pip@22.0.3	23.3	1
quay.io/opsmxpublic/awsgit :v3-js	15a6faada3d4	pip@22.0.4	23.3	1
quay.io/opsmxpublic/ubi8-oes-db :v3.0.0	89ee6493af89	pip@9.0.3	23.3	1
quay.io/opsmxpublic/ubi8-oes-platform :isd-spin-2025.10.01-a7c191ec-202511261122	8ed603ab7417	pip@9.0.3	23.3	1
quay.io/redhat-ai-dev/chatbot :latest	59fe607dfdf2	pip@22.3.1	23.3	1
quay.io/rhdh/rhdh-hub-rhel9 :latest	0b26358f5793	pip@22.3.1	23.3	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	pip@20.2.4	23.3	1
quay.io/soketi/pws :0.8-16-alpine	399d2e6b10ef	pip@21.2.4	23.3	1
quay.io/stackgres/operator :1.19.1	f241b0b20326	pip@23.2.1	23.3	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	pip@23.0.1	23.3	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb :4.4.5	cf72810d33f5	pip@9.0.3	23.3	1
registry.gitlab.com/infinitydon/registry/open5gs-aio :v2.2.2	f6385712935f	pip@20.0.2	23.3	1
registry.gitlab.com/open-forms/design-catalogue :latest	f21f19346b29	pip@20.3.3	23.3	1
registry.gitlab.com/open-forms/forms-catalogue :latest	4eaf9c911f33	pip@21.2.4	23.3	1
registry.gitlab.com/open-forms/request-registry :latest	0886cbbc5f95	pip@21.2.4	23.3	1
registry.gitlab.com/radiology/infrastructure/study-governor :8.0.0	4e7faf6f8d5f	pip@22.0.4	23.3	1