CVE-2021-39160
Critical
Description
nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.
SeverityCritical
CVSS9.6
Exploit probability—
ProductJupyterhub Nbgitpuller
PublishedAug 25, 2021
First seenAug 25, 2021
Weakness typeCWE-94Code injection
How to fix
Update
- jupyterhub nbgitpuller0.10.2 or later
- nbgitpuller0.10.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jupyterhub nbgitpuller | 0.9.0 ≤ v < 0.10.2 | 0.10.2 |
| nbgitpullerPyPI | 0.9.0 ≤ v < 0.10.2 | 0.10.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.