CVE-2022-41382: 
Python vulnerability analysis and mitigation

The d8s-json package for Python version 0.1.0, as distributed on PyPI, contained a potential code-execution backdoor that was inserted by a third party. The backdoor was implemented through the democritus-file-system package dependency (MITRE CVE, NVD). The vulnerability was discovered and disclosed on September 18, 2022.

The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 CRITICAL with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The issue affects version 0.1.0 of the d8s-json package when installed through PyPI (NVD).

The vulnerability allows attackers to execute arbitrary malicious code through the compromised democritus-file-system package dependency. Due to the critical CVSS score and the nature of the backdoor, this could lead to complete system compromise with high impacts on confidentiality, integrity, and availability of the affected systems (NVD).

Users should avoid using version 0.1.0 of the d8s-json package. The recommendation is to remove version 0.1.0 from PyPI to prevent further exploitation (GitHub Issue).