Em resumo
- CVE-2020-15271 é uma vulnerabilidade ALTO (CVSS 8.8) que afeta lookatme, lookatme (lookatme project).
- Chance de exploração nos próximos 30 dias (EPSS): 2.3%, maior que 83.5% das vulnerabilidades.
- Correção: atualize para 2.3.0 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| lookatme PyPI | < 2.3.0
| 2.3.0
|
| lookatme | < 2.3.0
| 2.3.0
|
Description
Impact
lookatme versions prior to 2.3.0 automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system.
Patches
Users should upgrade to lookatme versions 2.3.0 or above.
Workarounds
The lookatme/contrib/terminal.py and lookatme/contrib/file_loader.py files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
References
For more information
If you have any questions or comments about this advisory:
NVD description
In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free