{"id":"CVE-2021-3840","aliases":["GHSA-hgc3-hp6x-wpgx","PYSEC-2021-840"],"title":"Antilles Dependency Confusion Vulnerability","summary":"Antilles Dependency Confusion Vulnerability","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendor":"antilles-tools","product":"antilles-tools","ecosystem":"pip","affected":["antilles-tools < 1.0.1"],"patched":["antilles-tools 1.0.1"],"published":"2021-11-03","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-hgc3-hp6x-wpgx","references":[{"url":"https://github.com/lenovo/Antilles/security/advisories/GHSA-hgc3-hp6x-wpgx"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3840"},{"url":"https://github.com/lenovo/Antilles/commit/c7b9c5740908b343aceefe69733d9972e64df0b9"},{"url":"https://github.com/lenovo/Antilles"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/antilles-tools/PYSEC-2021-840.yaml"}],"tags":["osv","pip"],"epss":0.02036,"epssPercentile":0.80238,"ingestedAt":"2026-07-08T18:25:50.198Z","slug":"CVE-2021-3840","body":"## Overview\n\n### Potential Impact: \nRemote code execution.\n\n### Scope of Impact: \nOpen-source project specific.\n\n### Summary Description:\nA dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). \nMITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi.\nThe configuration has been updated to only install components built by Antilles, removing all other public package indexes. Additionally, the antilles-tools dependency has been published to PyPi.\n\n### Mitigation Strategy for Customers (what you should do to protect yourself):\nRemove previous versions of Antilles as a precautionary measure and Update to version 1.0.1 or later.\n\n### Acknowledgement:\nThe Antilles team thanks Kotko Vladyslav for reporting this issue.\n\n### References:\nhttps://github.com/lenovo/Antilles/commit/c7b9c5740908b343aceefe69733d9972e64df0b9\n\n\n## Affected packages\n\n- `antilles-tools < 1.0.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `antilles-tools 1.0.1`","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}