https://github.com/lenovo/Antilles/security/advisories/GHSA-hgc3-hp6x-wpgx

NIST AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NIST (AV:N/AC:M/Au:N/C:P/I:P/A:P)

NIST CWE-427

OR
     *cpe:2.3:a:lenovo:antilles:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.1

https://github.com/lenovo/Antilles/security/advisories/GHSA-hgc3-hp6x-wpgx No Types Assigned

https://github.com/lenovo/Antilles/security/advisories/GHSA-hgc3-hp6x-wpgx Patch, Third Party Advisory

Victim must voluntarily interact with attack mechanism

A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi).
MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi

A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi