En bref
- CVE-2020-15271 est une vulnérabilité ÉLEVÉE (CVSS 8.8) touchant lookatme, lookatme (lookatme project).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.3%, plus élevée que 83.5% des vulnérabilités.
- Correctif : mettre à jour vers 2.3.0 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| lookatme PyPI | < 2.3.0
| 2.3.0
|
| lookatme | < 2.3.0
| 2.3.0
|
Description
Impact
lookatme versions prior to 2.3.0 automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system.
Patches
Users should upgrade to lookatme versions 2.3.0 or above.
Workarounds
The lookatme/contrib/terminal.py and lookatme/contrib/file_loader.py files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
References
For more information
If you have any questions or comments about this advisory:
NVD description
In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free