GSD-2022-1002521
backdoor in ctx version 0.1.2-1, 0.1.2-2, 0.1.4, 0.2, 0.2.1, 0.2.2, 0.2.2.1, 0.2.3, 0.2.4, 0.2.5, 0.2.6
In PyPI ctx version 0.1.2-1, 0.1.2-2, 0.1.4, 0.2, 0.2.1, 0.2.2, 0.2.2.1, 0.2.3, 0.2.4, 0.2.5, 0.2.6 a backdoor exists in the ctx package that can be attacked via a malicious package update resulting in credential theft from environment variables
What each source reports
OSV No score
backdoor in ctx version 0.1.2-1, 0.1.2-2, 0.1.4, 0.2, 0.2.1, 0.2.2, 0.2.2.1, 0.2.3, 0.2.4, 0.2.5, 0.2.6
In PyPI ctx version 0.1.2-1, 0.1.2-2, 0.1.4, 0.2, 0.2.1, 0.2.2, 0.2.2.1, 0.2.3, 0.2.4, 0.2.5, 0.2.6 a backdoor exists in the ctx package that can be attacked via a malicious package update resulting in credential theft from environment variables
- Record
GSD-2022-1002521- Updated
- 2026-11-02
OSVPYSEC-2022-199 No score
The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items() when instantiating Ctx objects.
- Record
PYSEC-2022-199- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ctxPyPI |
0.1.2-1 and later, plus listed versions 0.1.2-20.1.40.20.2.10.2.2 Show 5 moreShow less0.2.2.10.2.30.2.40.2.50.2.6 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GSD-2022-1002521 is a vulnerability with no CVSS score yet in ctx, published May 24, 2022. No source lists public exploit code. No source names a fixed version.