CVE-2023-5752: Pypa Pip

Low severity, CVSS 3.3. EPSS: 0.5% chance of exploitation in the next 30 days.

When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

Affected products

• Pypa Pip: before 23.3 (fixed in 23.3)

Published 2023-10-25. Last modified 2026-06-17.