CVE-2021-39160: nbgitpuller Arbitrary Code Execution
Summary
PYSEC-2021-316: nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Affects nbgitpuller across 2 version ranges.
>= 0.9.0, < 0.10.2
< 07690644f29a566011dd0d7ba14cae3eb0490481
Fixed in 07690644f29a566011dd0d7ba14cae3eb0490481. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nbgitpuller is a Jupyter server extension that allows for one-way synchronization of a git repository to a local path. It is commonly used to sync Jupyter notebooks and other files from a remote repository to a local environment. The package is available on PyPI and its source code is hosted on GitHub. The vulnerability identified as CVE-2021-39160 allows for arbitrary code execution in the user environment when visiting maliciously crafted links.
Vulnerability Detail
The vulnerability in nbgitpuller arises from unsanitized input handling. Attackers can exploit this by creating specially crafted links that, when visited by a user, execute arbitrary code in their environment. This can lead to unauthorized access, data breaches, and potential compromise of the entire system. The vulnerability has been assigned the identifier CVE-2021-39160 and has been resolved in version 0.10.2 of nbgitpuller. Users are strongly advised to upgrade to the fixed version to mitigate the risk.
How To Fix
Latest published version: 1.3.0 as of 23 Oct 2026
pip install --upgrade "nbgitpuller==1.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
07690644f29a566011dd0d7ba14cae3eb0490481
This is the first release that contains the fix.
pip install --upgrade "nbgitpuller==07690644f29a566011dd0d7ba14cae3eb0490481"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability CVE-2021-39160 in nbgitpuller allows for arbitrary code execution in the user environment. It has been resolved in version 0.10.2 of the package, and all users are strongly advised to upgrade to this version or later. No known workarounds exist for users who cannot upgrade. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nbgitpuller →
FAQ
nbgitpuller is a Jupyter server extension that enables one-way synchronization of a git repository to a local path. It is commonly used to sync Jupyter notebooks and other files from a remote repository to a local environment.
The vulnerability allows for arbitrary code execution in the user environment when visiting maliciously crafted links. This can lead to unauthorized access, data breaches, and potential compromise of the entire system.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file and the playground will analyze it for any open-source vulnerabilities, including CVE-2021-39160.
No, there is no known workaround for this vulnerability. Users who cannot upgrade to version 0.10.2 or later of nbgitpuller are advised to exercise caution when visiting untrusted links and to consider disabling the affected functionality if possible.
You can find more information about this vulnerability, including its technical details and the fixed version, in the advisory database maintained by PyPA. The specific YAML file for this vulnerability can be found at: https://github.com/pypa/advisory-database/blob/main/vulns/nbgitpuller/PYSEC-2021-316.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for nbgitpuller.
