CVE-2020-19001: Command Injection in Simiki
Summary
CVE-2020-19001: Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64 of the component 'simiki/blob/master/simiki/config.py'. Affects simiki versions < 1.6.2.2. Fixed in 1.6.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Simiki is a Python package available on PyPI that is used for generating static websites. It provides a simple and flexible way to create and manage documentation. Simiki versions 1.6.2.1 and prior are affected by a command injection vulnerability. This vulnerability allows remote attackers to execute arbitrary system commands by exploiting line 64 of the 'simiki/blob/master/simiki/config.py' component.
Vulnerability Detail
The command injection vulnerability in Simiki can be exploited by remote attackers to execute arbitrary system commands. By manipulating the input in line 64 of the 'simiki/config.py' file, an attacker can inject malicious commands that will be executed by the system. This can lead to unauthorized access, data leakage, or even complete compromise of the affected system.
How To Fix
Minimum fixed version
1.6.2.2
This is the first release that contains the fix.
pip install --upgrade "simiki==1.6.2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to update to the latest version of Simiki to mitigate the risk of exploitation.
Conclusion
Simiki versions 1.6.2.1 and prior are vulnerable to a command injection issue that allows remote attackers to execute arbitrary system commands. To mitigate this vulnerability, it is crucial to update Simiki to version 1.6.2.2 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for simiki →
FAQ
Simiki is a Python package used for generating static websites and managing documentation.
This vulnerability allows remote attackers to execute arbitrary system commands, potentially leading to unauthorized access, data leakage, or complete compromise of the affected system.
To fix this vulnerability, update Simiki to version 1.6.2.2 or later.
There is no known workaround for this vulnerability. It is recommended to update to the latest version of Simiki.
For more information about this vulnerability, you can refer to the Simiki advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/simiki/PYSEC-2021-348.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for simiki.
