pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted res…
CVSS 2.0MEDIUM 6.8·Network·No auth·Interaction —·EPSS 0.02092·Published 2013-08-06·Fixed in 0.7.1CWE-20