CVE-2021-39160: Code injection in nbgitpuller
Summary
CVE-2021-39160: Code injection in nbgitpuller. Affects nbgitpuller versions >= 0.9.0, < 0.10.2. Fixed in 0.10.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nbgitpuller is a Python package available on PyPI that provides a mechanism for pulling Jupyter notebooks from a Git repository. It allows users to easily clone and update notebooks from a remote repository. The package is commonly used in JupyterHub environments. However, versions of nbgitpuller prior to 0.10.2 are vulnerable to a code injection attack.
Vulnerability Detail
The vulnerability in nbgitpuller arises from an unsanitized input that can be exploited by visiting maliciously crafted links. This can lead to arbitrary code execution in the user environment. An attacker could potentially inject and execute malicious code, compromising the integrity and confidentiality of the system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 1.3.0 as of 23 Oct 2026
pip install --upgrade "nbgitpuller==1.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10.2
This is the first release that contains the fix.
pip install --upgrade "nbgitpuller==0.10.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability other than upgrading to the fixed version (0.10.2) or downgrading to version 0.8.x if the latest version is not compatible with the system.
Conclusion
The code injection vulnerability in nbgitpuller can be mitigated by upgrading to version 0.10.2 or later. It is important to promptly apply the necessary patches to prevent the execution of arbitrary code. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nbgitpuller →
FAQ
nbgitpuller is a Python package that allows users to clone and update Jupyter notebooks from a Git repository.
The vulnerability allows for arbitrary code execution in the user environment, potentially compromising system integrity and confidentiality.
To fix the vulnerability, upgrade nbgitpuller to version 0.10.2 or later.
There are no known workarounds other than upgrading to the fixed version.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nbgitpuller.
