Plataforma SaaS de seguridad y gestión automatizada de dependencias Python que detecta, alerta y remedia vulnerabilidades en paquetes y versiones instaladas, con enfoque en configuraciones de índices múltiples.

Repository: jgeraigery/coremltools Author: mend-for-github-com[bot] <details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/vulnerability_details.png' width=19 height=20> Vulnerable Library - <b>pip-19.3.1-py37_0.conda</b></summary> <p>PyPA recommended tool for installing Python packages</p> <p>Library home page: <a href="http://repo.continuum.io/pkgs/main/linux-64/pip-19.3.1-py37_0.conda">http://repo.continuum.io/pkgs/main/linux-64/pip-19.3.1-py37_0.conda</a></p> <p>Path to dependency file: /deps/protobuf/python/docs/environment.yml</p> <p>Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/pip-19.3.1-py37_0.conda</p> <p> <p>Found in HEAD commit: <a href="https://github.com/jgeraigery/coremltools/commit/cb187ac68bbd85399a27da116bd477a755448e9e">cb187ac68bbd85399a27da116bd477a755448e9e</a></p></details> ## Vulnerabilities | Vulnerability | Severity | <img src='https://whitesource-resources.whitesourcesoftware.com/cvss3.png' width=19 height=20> CVSS | Exploit Maturity | EPSS | Dependency | Type | Fixed in (pip version) | Remediation Possible** | Reachability | | ------------- | ------------- | ----- | ----- | ----- | ----- | ----- | ------------- | --- | --- | | [CVE-2018-20225](https://www.mend.io/vulnerability-database/CVE-2018-20225) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.8 | Not Defined | 1.7% | pip-19.3.1-py37_0.conda | Direct | N/A | &#10060;| | | [CVE-2026-1703](https://www.mend.io/vulnerability-database/CVE-2026-1703) | <img src='https://whitesource-resources.whitesourcesoftware.com/low_vul.png?' width=19 height=20> Low | 3.5 | Not Defined | 0.0% | pip-19.3.1-py37_0.conda | Direct | https://github.com/pypa/pip.git - 26.0,pip - 26.0 | &#10060;| | <p>**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation</p> ## Details <details> <summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2018-20225</summary> ### Vulnerable Library - <b>pip-19.3.1-py37_0.conda</b> <p>PyPA recommended tool for installing Python packages</p> <p>Library home page: <a href="http://repo.continuum.io/pkgs/main/linux-64/pip-19.3.1-py37_0.conda">http://repo.continuum.io/pkgs/main/linux-64/pip-19.3.1-py37_0.conda</a></p> <p>Path to dependency file: /deps/protobuf/python/docs/environment.yml</p> <p>Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/pip-19.3.1-py37_0.conda</p> <p> Dependency Hierarchy: - :x: **pip-19.3.1-py37_0.conda** (Vulnerable Library) <p>Found in HEAD commit: <a href="https://github.com/jgeraigery/coremltools/commit/cb187ac68bbd85399a27da116bd477a755448e9e">cb187ac68bbd85399a27da116bd477a755448e9e</a></p> <p>Found in base branch: <b>main</b></p> </p> <p></p> ### Vulnerability Details <p> An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely Mend Note: The description of this vulnerability differs from MITRE. <p>Publish Date: 2020-05-08 <p>URL: <a href=https://www.mend.io/vulnerability-database/CVE-2018-20225>CVE-2018-20225</a></p> </p> <p></p> ### Threat Assessment <p> <p>Exploit Maturity: Not Defined</p> <p>EPSS: 1.7%</p> </p> <p></p> ### CVSS 3 Score Details (<b>7.8</b>) <p> Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High </p> For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>. </p> <p></p> </details><details> <summary><img src='https://whitesource-resources.whitesourcesoftware.com/low_vul.png?' width=19 height=20> CVE-2026-1703</summary> ### Vulnerable Library - <b>pip-19.3.1-py37_0.conda</b> <p>PyPA recommended tool for installing Python packages</p> <p>Library home page: <a href="http://repo.continuum.io/pkgs/main/linux-64/pip-19.3.1-py37_0.conda">http://repo.continuum.io/pkgs/main/linux-64/pip-19.3.1-py37_0.conda</a></p> <p>Path to dependency file: /deps/protobuf/python/docs/environment.yml</p> <p>Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/pip-19.3.1-py37_0.conda</p> <p> Dependency Hierarchy: - :x: **pip-19.3.1-py37_0.conda** (Vulnerable Library) <p>Found in HEAD commit: <a href="https://github.com/jgeraigery/coremltools/commit/cb187ac68bbd85399a27da116bd477a755448e9e">cb187ac68bbd85399a27da116bd477a755448e9e</a></p> <p>Found in base branch: <b>main</b></p> </p> <p></p> ### Vulnerability Details <p> When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations. <p>Publish Date: 2026-02-02 <p>URL: <a href=https://www.mend.io/vulnerability-database/CVE-2026-1703>CVE-2026-1703</a></p> </p> <p></p> ### Threat Assessment <p> <p>Exploit Maturity: Not Defined</p> <p>EPSS: 0.0%</p> </p> <p></p> ### CVSS 3 Score Details (<b>3.5</b>) <p> Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None </p> For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>. </p> <p></p> ### Suggested Fix <p> <p>Type: Upgrade version</p> <p>Release Date: 2026-02-02</p> <p>Fix Resolution: https://github.com/pypa/pip.git - 26.0,pip - 26.0</p> </p> <p></p> </details>