CVE-2020-15271

Description

In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.

How to fix CVE-2020-15271

To remediate CVE-2020-15271, upgrade the affected package to a fixed version below.

• —upgrade to 2.3.0-1 or later
• —upgrade to 2.3.0 or later
• —upgrade to 72fe36b784b234548d49dae60b840c37f0eb8d84 or later

Is CVE-2020-15271 being exploited?

Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 2.3.0-1
• from 0, < 2.3.0
• from 0, < 72fe36b784b234548d49dae60b840c37f0eb8d84 | from 0, < 2.3.0

CVSS scores

References (9)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-15271
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2020-15271
• PATCHgithub.com/d0c-s4vage/lookatme
• WEBgithub.com/d0c-s4vage/lookatme/commit/72fe36b784b234548d49dae60b840c37f0eb8d84