PT-2020-14329 · Lookatme · Lookatme

D0C-S4Vage · Published 2020-10-26 · Updated 2020-11-13 · CVE-2020-15271

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions lookatme versions prior to 2.3.0

Description The issue affects users who render untrusted markdown with lookatme, potentially allowing malicious shell commands to be automatically run on their system. This is due to the automatic loading of the built-in "terminal" and "file loader" extensions in affected versions.

Recommendations For versions prior to 2.3.0, upgrade to version 2.3.0 or above. As a temporary workaround, consider manually deleting the lookatme/contrib/terminal.py and lookatme/contrib/file loader.py files. It is also recommended to be aware of what is being rendered with lookatme to minimize potential risks.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-15271

GHSA-C84H-W6CR-5V8Q

PYSEC-2020-61

Affected Products

Lookatme

References · 13

• 🔥 https://github.com/d0c-s4vage/lookatme/pull/110 · Exploit
• https://github.com/d0c-s4vage/lookatme/commit/72fe36b784b234548d49dae60b840c37f0eb8d84 · Patch
• https://osv.dev/vulnerability/GHSA-c84h-w6cr-5v8q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15271 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-15271 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15271 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-61 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-15271 · Vendor Advisory
• https://github.com/d0c-s4vage/lookatme/security/advisories/GHSA-c84h-w6cr-5v8q · Note
• https://github.com/d0c-s4vage/lookatme/releases/tag/v2.3.0 · Note
• https://github.com/d0c-s4vage/lookatme · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/lookatme/PYSEC-2020-61.yaml · Note
• https://pypi.org/project/lookatme/#history · Note