The researcher identified that the python-json-logger package declared a dependency named msgspec-python313-pre in its pyproject.toml file, but this dependency was not present on PyPI and not registered by any entity. When users install python-json-logger with its development dependencies using the command pip install python-json-logger[dev] on Python 3.13 environments, they would unwittingly download and execute the malicious package. “This release did not have any malicious content as I do not want to break any policies set by PyPi.org and neither want to infect any of the users of the python-json-logger package,” stated the researcher. The issue occurred because despite the dependency being removed from the project repository through commit 1ce81a3 about a month ago, the changes were never pushed to a new version after 3.2.1, leaving users of those versions vulnerable. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The flaw, tracked as CVE-2025-27607 with an initial CVSS score of 8.8, affects versions 3.2.0 and 3.2.1 of the package and stems from an issue with a missing dependency. In a recent discovery, over 50,000 WordPress sites using the popular "Uncanny Automator" plugin have been found vulnerable to privilege escalation attacks. Security researcher @omnigodz discovered the vulnerability while conducting experimental research on supply chain attacks. The vulnerability arises because the msgspec-python313-pre dependency was deleted by its owner, leaving the name available for anyone to claim. Organizations using the affected library are advised to check their dependencies, upgrade to the patched version, and monitor for suspicious activity. The researcher has retained registration of the package name to prevent others from using it maliciously. The python-json-logger package is extremely popular, with over 43 million monthly downloads according to the PyPI BigQuery database. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. The vulnerability has been patched in version 3.3.0, which users should upgrade to immediately.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 07 Apr 2025 12:50:09 +0000