What is CVE-2021-39160?

CVE-2021-39160 is a critical-severity vulnerability in Jupyterhub Nbgitpuller, classified under Code Injection. CVSS score: 9.6/10. Published 2021-08-25.

How severe is CVE-2021-39160?

Critical severity. CVSS v3 base score is 9.6 out of 10.

RCE in Jupyterhub Nbgitpuller

CVE-2021-39160

nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.017 (75.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

Affected products

Jupyterhub Nbgitpuller — versions >= 0.9.0, < 0.10.2

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2021-39160?: CVE-2021-39160 is a critical-severity vulnerability in Jupyterhub Nbgitpuller, classified under Code Injection. CVSS score: 9.6/10. Published 2021-08-25.
How severe is CVE-2021-39160?: Critical severity. CVSS v3 base score is 9.6 out of 10.