CVE-2023-5752

Name of the Vulnerable Software and Affected Versions pip versions prior to v23.3

Description The issue is related to the injection of arbitrary configuration options to the "hg clone" call when installing a package from a Mercurial VCS URL using pip. This can modify how and which repository is installed. The vulnerability does not affect users who aren't installing from Mercurial.

Recommendations For pip versions prior to v23.3, update to version v23.3 or later to resolve the issue. As a temporary workaround, consider avoiding the installation of packages from Mercurial VCS URLs until the issue is resolved. Restrict access to the hg clone call to minimize the risk of exploitation. Avoid using the --config option in the "hg clone" call until the issue is resolved.