AVID-2026-R1160

Description

Vulnerability CVE-2022-42039

Details

The d8s-lists package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-dicts package. The affected version is 0.1.0.

Reason for inclusion in AVID: CVE-2022-42039 describes a backdoor causing potential code execution in the PyPI package d8s-lists, inserted by a third party. This is a software supply chain vulnerability affecting a Python dependency, which could be pulled into general-purpose AI software stacks (models, pipelines, deployment tooling) that rely on Python packages. The report provides explicit CVE-era signals and references (NVD, PyPI project pages, GitHub issue), giving clear evidence of the vulnerability and its potential impact in AI workflows.

References

• NVD entry
• https://pypi.org/project/d8s-lists/
• https://pypi.org/project/democritus-dicts/
• https://github.com/democritus-project/d8s-lists/issues/18

Affected or Relevant Artifacts

• Developer: n/a
• Deployer: n/a
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2022-10-11
• Version: 0.3.3
• AVID Entry