CVE-2024-21624
Description
nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.
How to fix
- nonebot nonebot2.2.0 or later
- nonebot22.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nonebot nonebot | 2.0.1 ≤ v < 2.2.0, 2.0.0 | 2.2.0 |
| nonebot2PyPI | 2.0.0a16 ≤ v < 2.2.0, 2.0.1 ≤ v < 2.2.0 | 2.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.