CVE-2020-15271: lookatme - Automatic Execution of Malicious Shell Commands
Summary
CVE-2020-15271: In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Affects lookatme across 2 version ranges.
< 2.3.0
< 72fe36b784b234548d49dae60b840c37f0eb8d84
Fixed in 72fe36b784b234548d49dae60b840c37f0eb8d84. How to fix ↓
Also tracked for
- lookatme · Debian:11
The same CVE-2020-15271 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lookatme is a Python package available on PyPI that is used for rendering markdown files. It provides various extensions to enhance the rendering process. However, versions prior to 2.3.0 automatically loaded the built-in "terminal" and "file_loader" extensions. This automatic loading feature can lead to the execution of malicious shell commands when rendering untrusted markdown files.
Vulnerability Detail
The vulnerability (CVE-2020-15271) in lookatme arises from the automatic loading of the "terminal" and "file_loader" extensions. If an attacker manages to trick a user into rendering a specially crafted markdown file using lookatme, they can execute arbitrary shell commands on the user's system. This can lead to unauthorized access, data loss, or other malicious activities. The vulnerability has been fixed in version 2.3.0 of the package.
How To Fix
Minimum fixed version
72fe36b784b234548d49dae60b840c37f0eb8d84
This is the first release that contains the fix.
pip install --upgrade "lookatme==72fe36b784b234548d49dae60b840c37f0eb8d84"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually delete the lookatme/contrib/terminal.py and lookatme/contrib/file_loader.py files. However, this workaround should only be used until the package is updated to version 2.3.0 or later.
Conclusion
The vulnerability in lookatme (CVE-2020-15271) allows for the automatic execution of malicious shell commands when rendering untrusted markdown files. Users should update their lookatme package to version 2.3.0 or later to fix the vulnerability. A temporary workaround is available by manually deleting specific files, but it is recommended to update the package as soon as possible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lookatme →
FAQ
lookatme is a Python package used for rendering markdown files. It provides various extensions to enhance the rendering process.
Versions of lookatme prior to 2.3.0 are affected by this vulnerability.
You can check the version of lookatme installed on your system by running the following command:
pip show lookatme
There are no known public exploits for this vulnerability at the moment.
You can find more information about this vulnerability in the PyPA Advisory Database:
https://github.com/pypa/advisory-database/blob/main/vulns/lookatme/PYSEC-2020-61.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for lookatme.
