Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Old versions of Limnoria and Supybot plugins can leak sensitive data

CVE-2019-19010 · published 6 years ago
Summary

Old versions of Limnoria and Supybot's math plugins can be exploited by attackers to access sensitive information, which could lead to security risks. You should update to the latest version of these plugins to ensure your system remains secure. If you're unable to update, consider restricting access to the vulnerable commands.

What to do
  • Update valentin lorentz limnoria to version 2019.11.09.
  • Update limnoria_project limnoria to version 2019.11.09 or later.
Affected software
Ecosystem VendorProductAffected versions
pip valentin lorentz limnoria < 2019.11.09
Fix: upgrade to 2019.11.09
– limnoria_project limnoria < 2019.11.09
cpe:2.3:a:limnoria_project:limnoria:*:*:*:*:*:*:*:*
– fedoraproject fedora 29
30
31
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
Original advisory text
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other im...
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published16 Nov 2019
Updated29 Oct 2026
First seen6 Mar 2026
Sources
GHSA-6g88-vr3v-76mf · GHSA
CVE-2019-19010 · NVD
Track software like this
Free during beta