Vulnerability Description
In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Lookatme Project | Lookatme | < 2.3.0 |
Related Weaknesses (CWE)
References
- https://github.com/d0c-s4vage/lookatme/commit/72fe36b784b234548d49dae60b840c37f0PatchThird Party Advisory
- https://github.com/d0c-s4vage/lookatme/pull/110ExploitThird Party Advisory
- https://github.com/d0c-s4vage/lookatme/releases/tag/v2.3.0Release NotesThird Party Advisory
- https://github.com/d0c-s4vage/lookatme/security/advisories/GHSA-c84h-w6cr-5v8qThird Party Advisory
- https://pypi.org/project/lookatme/#historyRelease NotesThird Party Advisory
- https://github.com/d0c-s4vage/lookatme/commit/72fe36b784b234548d49dae60b840c37f0PatchThird Party Advisory
- https://github.com/d0c-s4vage/lookatme/pull/110ExploitThird Party Advisory
- https://github.com/d0c-s4vage/lookatme/releases/tag/v2.3.0Release NotesThird Party Advisory
- https://github.com/d0c-s4vage/lookatme/security/advisories/GHSA-c84h-w6cr-5v8qThird Party Advisory
- https://pypi.org/project/lookatme/#historyRelease NotesThird Party Advisory
FAQ
What is CVE-2020-15271?
CVE-2020-15271 is a vulnerability with a CVSS score of 9.3 (CRITICAL). In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown m...
How severe is CVE-2020-15271?
CVE-2020-15271 has been rated CRITICAL with a CVSS base score of 9.3/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-15271?
Check the references section above for vendor advisories and patch information. Affected products include: Lookatme Project Lookatme.