critical9.6
CVE-2021-39160
Code injection in nbgitpuller
Impact
### Impact Due to an unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. ### Patches 0.10.2 ### Workarounds None, other than upgrade to 0.10.2 or downgrade to 0.8.x. ### For more information If you have any questions or comments about this advisory: * Open an issue in [nbgitpuller](https://github.com/jupyterhub/nbgitpuller/issues) * Email our security team at [security@ipython.org](mailto:security@ipython.org)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | nbgitpuller | >= 0.9.0, <= 0.10.1 | 0.10.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jupyterhub | Nbgitpuller | from 0.9.0 before 0.10.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/jupyterhub/nbgitpuller/blob/main/CHANGELOG.md#0102---2021-08-25
- https://github.com/jupyterhub/nbgitpuller/commit/07690644f29a566011dd0d7ba14cae3eb0490481
- https://github.com/jupyterhub/nbgitpuller/security/advisories/GHSA-mq5p-2mcr-m52j
- https://github.com/advisories/GHSA-mq5p-2mcr-m52j
- https://nvd.nist.gov/vuln/detail/CVE-2021-39160
- https://github.com/pypa/advisory-database/tree/main/vulns/nbgitpuller/PYSEC-2021-315.yaml