https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T07:32:19.236611+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2022-21548 cnvd-2022-21548 2026-10-19T07:32:19.240901+00:00 cnvd-2022-21548 https://cve.radiocsirt.org/vuln/euvd-2026-167522 EUVD-2026-167522 2026-10-19T07:32:19.240933+00:00 EUVD-2026-167522 https://cve.radiocsirt.org/vuln/fkie_cve-2022-21187 fkie_cve-2022-21187 2026-10-19T07:32:19.240947+00:00

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.

 https://cve.radiocsirt.org/vuln/ghsa-mv2w-4jqc-6fg4 GHSA-mv2w-4jqc-6fg4 — Command injection in libvcs and vcspull 2026-10-19T07:32:19.240974+00:00

Affected: PyPI: libvcs, PyPI: vcspull

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.

 https://cve.radiocsirt.org/vuln/gsd-2022-21187 gsd-2022-21187 2026-10-19T07:32:19.240998+00:00 gsd-2022-21187 https://cve.radiocsirt.org/vuln/pysec-2022-163 PYSEC-2022-163 2026-10-19T07:32:19.241009+00:00

Affected: PyPI: libvcs

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.