Security: multiple requests advisories appear reachable in deepwiki-open

[hamizan-azman]

Security: multiple requests advisories appear reachable in deepwiki-open

Summary

During local dependency-impact validation, we observed behavior indicating that
AsyncFuncAI/deepwiki-open reaches code paths involving vulnerable requests versions. Please review
whether the project currently pins or allows affected requests releases, and upgrade or constrain
the dependency if needed.

Affected dependency

• Repository: https://github.com/AsyncFuncAI/deepwiki-open
• Dependency: requests
• Version(s) observed: 2.19.1, 2.2.1, 2.32.3

Advisories observed

• CVE-2018-18074 / GHSA-x84v-xcm2-53pg: GHSA-x84v-xcm2-53pg
• CVE-2024-47081 / GHSA-9hjg-9r4m-mvj7: GHSA-9hjg-9r4m-mvj7
• CVE-2014-1830 / GHSA-652x-xj99-gmcc: GHSA-652x-xj99-gmcc
• CVE-2014-1829 / GHSA-cfj3-7x9c-4p3h: GHSA-cfj3-7x9c-4p3h

Local validation notes

• CVE-2018-18074, requests 2.19.1: Local proof showed sensitive Authorization header material in local output.
• CVE-2024-47081, requests 2.32.3: Local proof showed sensitive Authorization header material in local output.
• CVE-2014-1830, requests 2.2.1: Local proof showed sensitive Authorization header material in local output.
• CVE-2014-1829, requests 2.19.1: Local proof showed sensitive Authorization header material in local output.

Suggested fix

Please upgrade requests to a version that includes the upstream security fixes for the advisories
above, or add a dependency constraint that prevents affected versions from being installed.

Disclosure note

We have not opened a public security issue elsewhere for these rows. If you prefer a private disclosure route, please point us to the right channel.

[hamizan-azman]

Follow-up clarification on the local validation notes:

• CVE-2018-18074, requests 2.19.1: an HTTPS-to-HTTP redirect on the same host forwarded the Authorization header to the HTTP capture server.
• CVE-2024-47081, requests 2.32.3: a crafted URL caused netrc credentials for api.github.com to be sent to an attacker-controlled capture server.
• CVE-2014-1830, requests 2.2.1: a cross-host redirect forwarded the Authorization header to an attacker-controlled capture server.
• CVE-2014-1829, requests 2.19.1: an HTTPS-to-HTTP redirect leaked the Authorization token to the HTTP capture server.

All credential values were redacted in local evidence and are not included here.