CVE-2021-39160

2021-08-2518:15:08

Google

osv.dev

nbgitpuller

jupyter server

unsanitized input

arbitrary code execution

version 0.10.2

upgrade

vulnerability

AI Score

8.8

Confidence

High

EPSS

0.004

Percentile

74.0%

JSON

nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.