AVID-2026-R1121

Description

Vulnerability CVE-2022-38881

Details

The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.

Reason for inclusion in AVID: CVE-2022-38881 describes a backdoored Python package (d8s-archives 0.1.0) distributed via PyPI, enabling potential code execution. This is a software supply chain vulnerability in a Python package that could be used in AI pipelines and general-purpose AI system stacks (dependencies/runtimes). The report cites NVD, PyPI pages, and GitHub issue, providing sufficient evidence to classify as a vulnerability in the AI software supply chain.

References

• NVD entry
• https://pypi.org/project/democritus-strings/
• https://pypi.org/project/d8s-archives/
• https://github.com/democritus-project/d8s-archives/issues/12

Affected or Relevant Artifacts

• Developer: n/a
• Deployer: n/a
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2022-09-19
• Version: 0.3.3
• AVID Entry