CVE-2021-39160: Code injection in nbgitpuller
Impact
Due to an unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment.
Patches
0.10.2
Workarounds
None, other than upgrade to 0.10.2 or downgrade to 0.8.x.
For more information
If you have any questions or comments about this advisory:
Open an issue in nbgitpuller Email our security team at security@ipython.org
Other sources
nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/nbgitpullerto a version that resolves this vulnerability.Fixed in 0.10.2 - Upgrade
Upgrade
nbgitpullerto a version that resolves this vulnerability.Fixed in 0.10.2 - Upgrade
Upgrade
nbgitpullerto a version that resolves this vulnerability.Fixed in 0.8.x
Event History
Frequently Asked Questions
What is CVE-2021-39160?
CVE-2021-39160 is a vulnerability in the nbgitpuller Jupyter server extension that allows for arbitrary code execution in the user environment when visiting maliciously crafted links.
What is the severity of CVE-2021-39160?
CVE-2021-39160 has a severity score of 8.8 (critical).
How does CVE-2021-39160 impact users?
CVE-2021-39160 allows for arbitrary code execution in the user environment when visiting malicious links.
How can I fix CVE-2021-39160?
To fix CVE-2021-39160, upgrade to version 0.10.2 of nbgitpuller or downgrade to version 0.8.x.
Are there any workarounds for CVE-2021-39160?
No, there are no workarounds for CVE-2021-39160 other than upgrading to version 0.10.2 or downgrading to version 0.8.x.