GitStock

d0c-s4vage/lookatme · Security

Markdown-supplied Shell Command Execution

GHSA ID
GHSA-c84h-w6cr-5v8q
CVE ID
CVE-2020-15271
Severity
critical
Published
Updated
CVSS
9.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v3
9.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Description

Impact

lookatme versions prior to 2.3.0 automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system.

Patches

Users should upgrade to lookatme versions 2.3.0 or above.

Workarounds

The lookatme/contrib/terminal.py and lookatme/contrib/file_loader.py files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.

References

For more information

If you have any questions or comments about this advisory:

CWEs

  • CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

References