CVE-2021-39160: nbgitpuller Arbitrary Code Execution
Summary
CVE-2021-39160: nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Affects nbgitpuller across 2 version ranges.
>= 0.9.0, < 0.10.2
< 07690644f29a566011dd0d7ba14cae3eb0490481
Fixed in 07690644f29a566011dd0d7ba14cae3eb0490481. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nbgitpuller is a Jupyter server extension that allows for one-way synchronization of a git repository to a local path. It is commonly used in JupyterHub environments. The package is available on PyPI and its source code is hosted on GitHub. The vulnerability described in this report allows for arbitrary code execution in the user environment when visiting maliciously crafted links.
Vulnerability Detail
The vulnerability arises from unsanitized input handling in nbgitpuller. Attackers can exploit this by creating specially crafted links that, when visited by a user, execute arbitrary code in their environment. This can lead to various consequences, such as unauthorized access, data loss, or further compromise of the system. The vulnerability has been assigned the identifier CVE-2021-39160 and has been resolved in version 0.10.2 of nbgitpuller.
How To Fix
Minimum fixed version
07690644f29a566011dd0d7ba14cae3eb0490481
This is the first release that contains the fix.
pip install --upgrade "nbgitpuller==07690644f29a566011dd0d7ba14cae3eb0490481"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in nbgitpuller allows for arbitrary code execution in the user environment. Users are strongly advised to upgrade to version 0.10.2 to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nbgitpuller →
FAQ
nbgitpuller is a Jupyter server extension that allows for one-way synchronization of a git repository to a local path. It is commonly used in JupyterHub environments.
The vulnerability allows for arbitrary code execution in the user environment when visiting maliciously crafted links. This can lead to unauthorized access, data loss, or further compromise of the system.
To fix this vulnerability, upgrade to version 0.10.2 of nbgitpuller. Ensure that all instances of nbgitpuller are updated to the fixed version.
No workarounds exist for users who cannot upgrade to version 0.10.2. It is recommended to prioritize upgrading to the fixed version.
You can find more information about this vulnerability in the advisory database of the PyPA organization on GitHub.
References
Related vulnerabilities
Recent vulnerabilities recorded for nbgitpuller.
