GitHub Advisoryadvisory · PyPI
GHSA-mq5p-2mcr-m52j Code injection in nbgitpuller
HIGH
Official page ↗
- Aliases
- CVE-2021-39160
- Ecosystem
- PyPI
- Packages
- nbgitpuller
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-78, CWE-94
- Reviewed
- 2021-08-25
Affected packages
• PyPI nbgitpuller: >= 0.9.0, < 0.10.2 → fixed in 0.10.2
Description
Impact
Due to an unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment.
Patches
0.10.2
Workarounds
None, other than upgrade to 0.10.2 or downgrade to 0.8.x.
For more information
If you have any questions or comments about this advisory:
• Open an issue in nbgitpuller
• Email our security team at [email protected]
Related
Alias · CVE (1)
- CVE-2021-39160 nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. vulnerability
References
- https://github.com/jupyterhub/nbgitpuller/security/advisories/GHSA-mq5p-2mcr-m52j web
- https://nvd.nist.gov/vuln/detail/CVE-2021-39160 advisory
- https://github.com/jupyterhub/nbgitpuller/commit/07690644f29a566011dd0d7ba14cae3eb0490481 web
- https://github.com/jupyterhub/nbgitpuller package
- https://github.com/jupyterhub/nbgitpuller/blob/main/CHANGELOG.md#0102---2021-08-25 web
- https://github.com/pypa/advisory-database/tree/main/vulns/nbgitpuller/PYSEC-2021-315.yaml web