GHSA-mq5p-2mcr-m52j

Code injection in nbgitpuller

Source: GitHub Advisory Database (reviewed) High CVE-2021-39160

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	nbgitpuller	>= 0.9.0, < 0.10.2	0.10.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Due to an unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. ### Patches 0.10.2 ### Workarounds None, other than upgrade to 0.10.2 or downgrade to 0.8.x. ### For more information If you have any questions or comments about this advisory: * Open an issue in [nbgitpuller](https://github.com/jupyterhub/nbgitpuller/issues) * Email our security team at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.

https://github.com/jupyterhub/nbgitpuller/security/advisories/GHSA-mq5p-2mcr-m52j web
https://nvd.nist.gov/vuln/detail/CVE-2021-39160 advisory
https://github.com/jupyterhub/nbgitpuller/commit/07690644f29a566011dd0d7ba14cae3eb0490481 web
https://github.com/jupyterhub/nbgitpuller package
https://github.com/jupyterhub/nbgitpuller/blob/main/CHANGELOG.md#0102---2021-08-25 web
https://github.com/pypa/advisory-database/tree/main/vulns/nbgitpuller/PYSEC-2021-315.yaml web