CVE-2020-15271

Katalog CVE

CVSS 8.8 · High EPSS 2,3%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada lookatme project lookatme. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.

Rincian

Terbit di NVD

26 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/d0c-s4vage/lookatme/commit/72fe36b784b234548d49dae60b840c37f0eb8d84 patch · advisory pihak ketiga
• https://github.com/d0c-s4vage/lookatme/pull/110 exploit · advisory pihak ketiga
• https://github.com/d0c-s4vage/lookatme/releases/tag/v2.3.0 release notes · advisory pihak ketiga
• https://github.com/d0c-s4vage/lookatme/security/advisories/GHSA-c84h-w6cr-5v8q advisory pihak ketiga
• https://pypi.org/project/lookatme/#history release notes · advisory pihak ketiga