Critical · 9.8 CVE-2022-42039 EUVD-2022-0061GHSA-92ff-vfmh-hx3rPYSEC-2022-43027PYSEC-2022-43037

The d8s-lists package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backd…

Published Oct 11, 2022 · Updated May 19, 2025 · Assigned by mitre

Package: d8s-lists Package: democritus-dicts Ecosystem: PyPI

Description

The d8s-lists package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-dicts package. The affected version is 0.1.0.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	d8s-lists	all versions	—	PYSEC-2022-43027
PyPI	democritus-dicts	all versions	—	PYSEC-2022-43037

References

https://pypi.org/project/d8s-lists/
https://pypi.org/project/democritus-dicts/
https://github.com/democritus-project/d8s-lists/issues/18