CVE-2023-39523

What it is

ScanCode.io is a server to script and automate software composition analysis with ScanPipe pipelines. Prior to version 32.5.1, the software has a possible command injection vulnerability in the docker fetch process as it allows to append malicious commands in the `docker_reference` parameter. In the function `scanpipe/pipes/fetch.py:fetch_docker_image` the parameter `docker_reference` is user controllable. The `docker_reference` variable is then passed to the vulnerable function `get_docker_image_platform`. However, the `get_docker_image_plaform` function constructs a shell command with the passed `docker_reference`. The `pipes.run_command` then executes the shell command without any prior sanitization, making the function vulnerable to command injections. A malicious user who is able to create or add inputs to a project can inject commands. Although the command injections are blind and the user will not receive direct feedback without logs, it is still possible to cause damage to the server/container. The vulnerability appears for example if a malicious user adds a semicolon after the input of `docker://;`, it would allow appending malicious commands. Version 32.5.1 contains a patch for this issue. The `docker_reference` input should be sanitized to avoid command injections and, as a workaround, one may avoid creating commands with user controlled input directly.

At a glance

Exploitability

Can be exploited from the same network segment with a low-privilege account. High risk of service disruption.

Exploit odds

2.9% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2023-08-07 21:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 06:12 UTC Last updatedMost recent change to the record

Why it ranks here

• Exploited in the wild: no, CISA does not list it.
• Exploit odds: 2.9% in the next 30 days (EPSS).
• Severity: 6.8 MEDIUM (CVSS).
• Fix: a patch or advisory is linked.

Details

Published

2023-08-07 21:15 UTC

Last modified

2026-06-17 06:12 UTC

Exploit probability

2.9% · EPSS, next 30 days

Weakness

CWE-77 · Command injection

Record status

Modified

Affected

• Nexb scancode.io < 32.5.1

Attack profile CVSS 3.1 · 6.8

Attack vector

Adjacent network

Complexity

Low

Privileges needed

Low

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2023-39523.md and follow it. Check whether this project is affected by CVE-2023-39523. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

Copy as ticket · More options · Status badge