A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.01177·Published 2023-06-30·Fixed in 0.4.12CWE-427