Description
In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
d0c-s4vage lookatme
< 2.3.0affected
References
- https://github.com/d0c-s4vage/lookatme/security/advisories/GHSA-c84h-w6cr-5v8q ↗
- https://github.com/d0c-s4vage/lookatme/pull/110 ↗
- https://github.com/d0c-s4vage/lookatme/commit/72fe36b784b234548d49dae60b840c37f0eb8d84 ↗
- https://github.com/d0c-s4vage/lookatme/releases/tag/v2.3.0 ↗
- https://pypi.org/project/lookatme/#history ↗