Command Injection Affecting talkpipe package, versions [,0.9.0a2)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-TALKPIPE-13807332
- published2 Nov 2025
- disclosed1 Nov 2025
- creditUnknown
Introduced: 1 Nov 2025
New CVE NOT AVAILABLE CWE-78 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade talkpipe to version 0.9.0a2 or higher.
Overview
talkpipe is a Python internal and external DSL for writing generative AI analytics
Affected versions of this package are vulnerable to Command Injection via the talkpipe.util.os.run_command function which use subprocess.Popen(..., shell=True) unsafe. An attacker can execute arbitrary operating system (OS) commands by injecting shell metacharacters, pipes, or command substitution sequences into the user-controlled command string.