En resumen
- CVE-2020-15271 es una vulnerabilidad ALTO (CVSS 8.8) que afecta a lookatme, lookatme (lookatme project).
- Probabilidad de explotación en los próximos 30 días (EPSS): 2.3%, mayor que el 83.5% de las vulnerabilidades.
- Solución: actualizar a 2.3.0 o posterior.
| Package | Affected versions | Patched versions |
|---|
| lookatme PyPI | < 2.3.0
| 2.3.0
|
| lookatme | < 2.3.0
| 2.3.0
|
Description
Impact
lookatme versions prior to 2.3.0 automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system.
Patches
Users should upgrade to lookatme versions 2.3.0 or above.
Workarounds
The lookatme/contrib/terminal.py and lookatme/contrib/file_loader.py files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
References
For more information
If you have any questions or comments about this advisory:
NVD description
In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free