CVE-2022-21668: Pipenv's requirements.txt parsing allows malicious index url in comments

Due to a flaw in pipenv’s parsing of requirements files, an attacker can insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file (e.g. with “pipenv install -r requirements.txt”) to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the attacker can trigger arbitrary remote code execution (RCE) on the victims’ systems.