Critical Vulnerability in Lookatme Package: Automatic Execution of Malicious Commands
Summary
DEBIAN-CVE-2020-15271: In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Affects lookatme versions < 2.3.0-1. Fixed in 2.3.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lookatme is a Python package designed for rendering markdown content, allowing users to create visually appealing presentations and documents. It is widely used for its simplicity and effectiveness in handling markdown syntax. However, prior to version 2.3.0, Lookatme had a significant security flaw that enabled the automatic loading of built-in extensions, which could lead to the execution of malicious shell commands when rendering untrusted markdown.
Vulnerability Detail
The vulnerability in Lookatme arises from its automatic loading of the 'terminal' and 'file_loader' extensions in versions prior to 2.3.0. This design flaw allows attackers to craft markdown content that, when rendered, executes arbitrary shell commands on the user's system. The implications of this vulnerability are severe, as it can lead to unauthorized access, data breaches, or system compromise, particularly for users who render untrusted markdown content.
How To Fix
Minimum fixed version
2.3.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lookatmeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As an immediate workaround, users can manually delete the 'terminal.py' and 'file_loader.py' files located in the 'lookatme/contrib/' directory. This action will prevent the automatic loading of these extensions and mitigate the risk of executing malicious commands.
Conclusion
The Lookatme package has a critical vulnerability that allows for the execution of malicious commands through untrusted markdown rendering. Users are strongly advised to update to version 2.3.0 or later to mitigate this risk. Additionally, manual workarounds can be employed until an update can be performed.
See every vulnerability recorded for lookatme →
FAQ
All versions of Lookatme prior to 2.3.0 are affected by this vulnerability.
The risks include unauthorized execution of shell commands, which can lead to data breaches, system compromise, and loss of sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not possible, manually deleting the 'terminal.py' and 'file_loader.py' files is recommended as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for lookatme.
