lookatme versions prior to 2.3.0 automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system.
Users should upgrade to lookatme versions 2.3.0 or above.
The lookatme/contrib/terminal.py
and lookatme/contrib/file_loader.py
files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
If you have any questions or comments about this advisory:
{ "nvd_published_at": null, "cwe_ids": [ "CWE-78" ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2020-10-26T18:07:46Z" }