How-To: Audit Your Python Projects for Known CVEs With pip-audit

With Python CVEs tripling in a year, I run a quick check on the virtual environments my bots and scripts use. pip-audit, from the Python Packaging Authority, checks installed packages against known vulnerability data.

Install it

python -m venv ~/.venvs/audit
~/.venvs/audit/bin/pip install pip-audit

Audit a project

Activate the project’s own venv and run it there so it sees what’s actually installed:

cd ~/projects/mybot
source .venv/bin/activate
pip install pip-audit
pip-audit

Or point it at a requirements file without installing anything:

pip-audit -r requirements.txt

Fix what it finds

• Each finding shows the package, version, vulnerability ID and the fixed version.
• pip-audit --fix can upgrade to fixed versions for you. Run your tests afterward.
• Pin the fixed versions back into requirements.txt.

Make it routine

I add a weekly check to my automation and only look when something’s flagged. pip-audit exits non-zero when it finds a vulnerability, so it drops right into a script or CI job.

Isolate it: try new software in a disposable VM or spare machine first, with a backup you can roll back to.

God Bless, and Use the Source!

References & Further Reading

• pip-audit (PyPI)
• pip-audit on GitHub (PyPA)
• Python’s CVEs triple (Slashdot)