Tóm tắt nhanh
- CVE-2020-15271 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng lookatme, lookatme (lookatme project).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 2.3%, cao hơn 83.5% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 2.3.0 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| lookatme PyPI | < 2.3.0
| 2.3.0
|
| lookatme | < 2.3.0
| 2.3.0
|
Mô tả
Impact
lookatme versions prior to 2.3.0 automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system.
Patches
Users should upgrade to lookatme versions 2.3.0 or above.
Workarounds
The lookatme/contrib/terminal.py and lookatme/contrib/file_loader.py files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
References
For more information
If you have any questions or comments about this advisory:
Mô tả của NVD
In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí