AVID-2026-R1041

Description

Vulnerability CVE-2022-30882

Details

pyanxdns package in PyPI version 0.2 is vulnerable to code execution backdoor. The impact is: execute arbitrary code (remote). When installing the pyanxdns package of version 0.2, the request package will be installed.

Reason for inclusion in AVID: The CVE describes a code execution backdoor in a Python packaging dependency (pyanxdns 0.2) that executes during installation by pulling in the request package. This is a software supply chain vulnerability affecting package dependencies. While not AI-specific, it directly impacts components commonly used in AI/ML workflows (Python ecosystems, dependencies, packaging). The report provides explicit vulnerability behavior and references, supporting a security/supply-chain classification relevant to AI systems.

References

• NVD entry
• http://pypi.doubanio.com/simple/request
• https://pypi.org/project/pyanxdns/
• https://github.com/egeback/pyanxdns/issues/1

Affected or Relevant Artifacts

• Developer: n/a
• Deployer: n/a
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2022-06-08
• Version: 0.3.3
• AVID Entry