Security
Research Uncovers Blind Spot in Python Security: Vendored Libraries Evade Detection
A new study reveals how Python packages bundling third-party native code create hard-to-detect vulnerabilities that existing scanners routinely miss.
Researchers have identified a significant gap in how Python application security scanners detect vulnerabilities in bundled native libraries—a packaging practice called vendoring that leaves thousands of applications potentially at risk.
The Vendoring Problem#
When Python package developers include compiled native libraries (such as OpenSSL) directly within their code rather than relying on system-provided versions, they create a detection problem. Standard vulnerability scanners face a catch-22: they either overlook these bundled binaries entirely, missing real security flaws, or flag them without understanding where they came from, producing false alarms when upstream projects have already patched the issues.
A New Approach to Finding Provenance#
The research demonstrates that properly identifying vulnerable code requires pinpointing exactly where each binary came from—its upstream source, version number, and in many cases, which operating system package it originated from. The team developed two complementary techniques to recover this provenance:
- For copied binaries: When Python tools repackage code from OS distributions, they modify metadata but leave the executable unchanged. The researchers hash this executable code and match it against historical OS package records to trace its origin.
- For built-from-source libraries: They generate custom analysis rules that dynamically inspect each binary to extract version information through its exposed interfaces.
Scale and Impact#
Testing their approach across nearly 1,900 Python packages containing vendored native code, the team successfully determined exact provenance in 73.4% of cases overall—and crucially, in 94.9% of practically relevant scenarios where the libraries had documented security vulnerabilities. They then performed the first cross-ecosystem reachability analysis, checking the top 100,000 Python packages against 10 known vulnerabilities in native libraries.
The findings were sobering: 39 directly vulnerable packages collectively downloaded over 47 million times monthly, plus 312 additional packages indirectly affected through dependencies. The researchers disclosed all findings to maintainers, with 54 fixes applied so far.
