Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

nbgitpuller: Visiting malicious links can execute code in your environment

CVE-2021-39160 · published 5 years ago
Summary

The nbgitpuller extension for Jupyter servers has a security flaw that allows hackers to run malicious code on your system if you visit a specially crafted link. This flaw has been fixed in version 0.10.2, so you should update to this version or later. If you can't update, you're at risk until you do.

What to do
  • Update peter veerman nbgitpuller to version 0.10.2.
  • Update jupyterhub nbgitpuller to version 0.10.2 or later.
Affected software
Ecosystem VendorProductAffected versions
pip peter veerman nbgitpuller >= 0.9.0, <= 0.10.1
Fix: upgrade to 0.10.2
– jupyterhub nbgitpuller >= 0.9.0, < 0.10.2
cpe:2.3:a:jupyterhub:nbgitpuller:*:*:*:*:*:*:*:*
Original advisory text
nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in ...
nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.7 High
Exploitation
2% chance of attack within 30 days
Type
CWE-78OS Command Injection
CWE-94Code Injection
Timeline
Published25 Aug 2021
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-mq5p-2mcr-m52j · GHSA
CVE-2021-39160 · NVD
Track software like this
Free during beta