CVE-2023-5752

Medium

Advisory

Published 25 Oct 2023In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.005; 40th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 756; of 17,787 indexed, latest versions
Container images: 786; deployed by those charts
Fix available: 1 of 2; affected packages

Command Injection in pip when used with Mercurial

Carried by container images the latest versions of 756 of 17,787 indexed charts deploy, on 786 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+50 more	23.3	786
python-pipdeb	23.0.1+dfsg-1	no fix listed	25

OSV records: GHSA-mq26-g339-26xf DEBIAN-CVE-2023-5752
Also known as: PYSEC-2023-228

Charts affected

756 by stars

Chart

Latest

Affected images

Radar Score

xkopsxkops

0.1.0

3 of 5 See more

xkops xkops 0.1.0

3 of the 5 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	pip@23.0.1	23.3
hamzaarshad10/querypodpy :1.7	154f38e8668e	pip@23.0.1	23.3
murtazashah46/helmfile :latest	4d11726cf803	pip@23.0.1	23.3

Open the chart page →

13,197

zahori-serverzahori

1.0.1

1 of 2 See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
flyway/flyway :9.14.1-alpine	80f12c80502b	pip@22.3.1	23.3

Open the chart page →

5,847

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	pip@9.0.3	23.3

Open the chart page →

6,016

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	pip@22.3.1	23.3

Open the chart page →

1,838

alertmanager-matrix-forwarderzloi-space

1.0.1

1 of 2 See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	pip@21.2.4	23.3

Open the chart page →

3,118

grafana-matrix-forwarderzloi-space

1.0.0

1 of 2 See more

grafana-matrix-forwarder zloi-space 1.0.0

1 of the 2 container images this version deploys carry CVE-2023-5752.

Container image	Digest	Package	Fixed in
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	pip@21.2.4	23.3

Open the chart page →

1,636

Container images carrying it

786 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
apachepulsar/pulsar :2.8.2	d538416d5afe	pip@21.3.1	23.3	1
apache/ranger :2.7.0	76c176e8a0e4	pip@22.0.2	23.3	1
apache/superset :9cdaa280429ec297db16d56c94fd77b5d2aff107	975ab033580d	pip@21.2.4	23.3	1
apache/superset :4.0.1	ab9467fd712c	pip@23.0.1	23.3	1
apsl/thumbor :6.7.0	51e2de5c2c70	pip@19.3.1	23.3	1
aquasec/kube-hunter :195	0bf607ce9308	pip@18.1	23.3	1
archish27/python-fastapi-postgres :latest	6610071a2101	pip@22.0.4	23.3	1
asdkant/fastapi-hello-world :latest	a23d8bf7c885	pip@20.3.3	23.3	1
assistiot/authorization_db :latest	c3adbab6a3e7	pip@20.2.4	23.3	1
assistiot/cybersecurity-monitoring_id-wzh :latest	0aacefac9677	pip@21.1.3	23.3	1
assistiot/fl_local_operations_inference :latest	0518b63a2e69	pip@23.2.1	23.3	1
assistiot/fl_repository :latest	0fce3ea719a5	pip@20.1.1	23.3	1
assistiot/fl_training_collector :latest	792715dd3084	pip@23.2.1	23.3	1
assistiot/identity-manager_kc :latest	0df4b4fa899a	pip@9.0.3	23.3	1
assistiot/open_api_backend :1.1.2	30812ba93555	pip@22.0.2	23.3	1
assistiot/resource-provisioning_api :1.0.0	44a37b00d4f8	pip@23.0.1	23.3	1
assistiot/resource-provisioning_im :1.0.0	a942dc14030a	pip@23.0.1	23.3	1
assistiot/resource-provisioning_prc :1.0.0	8b5d118bdf0e	pip@20.3.4	23.3	1
assistiot/smart-orchestrator_mcs :latest	7d6a0d534c7f	pip@23.0.1	23.3	1
assistiot/smart-orchestrator_scheduler :latest	38b003e55ff3	pip@23.0.1	23.3	1
assistiot/smart-orchestrator_scheduler_mc :latest	b1dbe4d62a03	pip@23.0.1 python-pip@23.0.1+dfsg-1	23.3 no fix listed	1
assistiot/traffic-classification_api :2.0.0	e32b87786142	pip@23.0.1	23.3	1
assistiot/video_augmentation :runner-cpu-latest	e5ae539ce2cb	pip@23.0.1	23.3	1
avinash263/pyredis263 :latest	aa2b8727f1a6	pip@23.0.1	23.3	1
azhar008/flaskapplication :latest	a1e827b0adea	pip@21.2.4	23.3	1
badsmoke/wunderground_exporter :0.0.5	c54c004f24cc	pip@21.0.1	23.3	1
balihb/block-pvc-scanner :0.2.4	5b95e1cf1158	pip@21.2.4	23.3	1
balihb/pod-pvc-mapping :0.2.4	ee48e79f5d76	pip@21.2.4	23.3	1
baserow/backend :1.31.1	e0b3c8130b91	pip@23.0.1 python-pip@23.0.1+dfsg-1	23.3 no fix listed	1
baserow/baserow :1.30.1	df0c42eb67e8	pip@23.0.1 python-pip@23.0.1+dfsg-1	23.3 no fix listed	1
bbvalabs/sensitive-data :1.0.1	3ea299ae63c0	pip@21.0.1	23.3	1
behnambm/docker-sample :v1	bd3ad88afff9	pip@23.0.1	23.3	1
benbusby/whoogle-search :0.5.4	f77f7e6e4ad2	pip@21.1.2	23.3	1
berkeleyskypilot/skypilot :0.13.0	3bc8bf8f4d83	pip@23.0.1	23.3	1
berkeleyskypilot/skypilot-nightly :latest	8da2f3cda472	pip@23.0.1	23.3	1
bicarus/elrond-rosetta :v1.3.50.0	b1dab0721e1c	pip@20.0.2	23.3	1
billimek/comcastusage-for-influxdb :latest	801bba1228ac	pip@10.0.1	23.3	1
billimek/prometheus-uptimerobot-exporter :0.0.1	f14ccd7aad0e	pip@20.1.1	23.3	1
billimek/sb6183-for-influxdb :latest	bf8158556035	pip@9.0.1	23.3	1
blacktop/httpie :latest	fc5e68e2f5ab	pip@18.1	23.3	1
blakeblackshear/frigate :0.10.0-amd64	ae269270ad9e	pip@20.0.2	23.3	1
bnjbvr/kresus :0.22.1	37e216b182c8	pip@23.0.1 python-pip@23.0.1+dfsg-1	23.3 no fix listed	1
bootc/puppetboard :1.1.0	f1383295e7be	pip@19.2.3	23.3	1
bryanalves/sickrage :latest	42f0a130001d	pip@9.0.0	23.3	1
buildkite/agent :3.25.0	aec38cfaae0e	pip@20.2.4	23.3	1
buntha/mlflow :2.1.1	154542cc3083	pip@22.0.4	23.3	1
cadmusthefounder/lnd :take-the-helm-0.1.0	e596c5fbf80f	pip@22.0.4	23.3	1
camerahub/camerahub :0.36.23	a5af37dd6e1b	pip@22.0.4	23.3	1
camptocamp/bucket-cloner :latest	acfafc308d88	pip@21.2.1	23.3	1
camptocamp/ekorre :0.1.0	35c91d5fda04	pip@20.0.2	23.3	1