GitHub Advisoryadvisory · PyPI
GHSA-h6h9-pphv-m266 Topydo Improper Input Validation vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2018-1000523
- Ecosystem
- PyPI
- Packages
- topydo
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
- Weaknesses
- CWE-20
- Reviewed
- 2020-06-16
Affected packages
• PyPI topydo: <= 0.13 (no fix yet)
Description
topydo contains a CWE-20: Improper Input Validation vulnerability in `ListFormatParser::parse`, file `topydo/lib/ListFormat.py` line 292 as of d4f843dac71308b2f29a7c2cdc76f055c3841523 that can result in Injection of arbitrary bytes to the terminal, including terminal escape code sequences. This attack appear to be exploitable via The victim must open a todo.txt with at least one specially crafted line.
Related
Alias · CVE (1)
- CVE-2018-1000523 topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000523 advisory
- https://github.com/bram85/topydo/issues/240 web
- https://github.com/advisories/GHSA-h6h9-pphv-m266 advisory
- https://github.com/bram85/topydo package
- https://github.com/bram85/topydo/blob/master/topydo/lib/ListFormat.py#L292 web
- https://github.com/pypa/advisory-database/tree/main/vulns/topydo/PYSEC-2018-76.yaml web