{"id":"CVE-2021-39160","aliases":["EUVD-2021-0141","GHSA-mq5p-2mcr-m52j","PYSEC-2021-315"],"status":"published","title":"Code injection in nbgitpuller","description":"nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0173,"percentile":0.7777,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78","CWE-94"],"published":"2021-08-25T18:10:11Z","modified":"2026-10-20T10:54:53Z","fixes":[{"ecosystem":"PyPI","package":"nbgitpuller","fixed_in":["0.10.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"nbgitpuller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"last_affected":"0.10.1"},{"fixed":"0.10.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"nbgitpuller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.10.2"}]}],"versions":["0.10.0","0.10.1","0.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"nbgitpuller","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"07690644f29a566011dd0d7ba14cae3eb0490481"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.10.2"}]}],"versions":["0.10.0","0.10.1","0.9.0"]}],"products":[{"vendor":"jupyterhub","product":"nbgitpuller"}],"references":[{"url":"https://github.com/jupyterhub/nbgitpuller/security/advisories/GHSA-mq5p-2mcr-m52j","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/jupyterhub/nbgitpuller/commit/07690644f29a566011dd0d7ba14cae3eb0490481","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/jupyterhub/nbgitpuller/blob/main/CHANGELOG.md#0102---2021-08-25","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39160","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/nbgitpuller/PYSEC-2021-315.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mq5p-2mcr-m52j"},{"url":"https://github.com/jupyterhub/nbgitpuller","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-39160","title":"Code injection in nbgitpuller","description":"nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.","status":"published","published":"2021-08-25T18:10:11Z","modified":"2024-08-04T01:58:18.218Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:33:09.175141Z"}],"euvd":[{"id":"EUVD-2021-0141","description":"nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.","status":"published","published":"2021-08-25T18:10:11Z","modified":"2024-08-04T01:58:18Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:24:24.305495Z"}],"ghsa":[{"id":"GHSA-mq5p-2mcr-m52j","title":"Code injection in nbgitpuller","description":"### Impact\n\nDue to an unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment.\n\n### Patches\n\n0.10.2\n\n### Workarounds\n\nNone, other than upgrade to 0.10.2 or downgrade to 0.8.x.\n\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [nbgitpuller](https://github.com/jupyterhub/nbgitpuller/issues)\n* Email our security team at [security@ipython.org](mailto:security@ipython.org)\n","status":"published","published":"2021-08-30T16:17:06Z","modified":"2024-10-03T21:28:39Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78","CWE-94"],"updated_at":"2026-11-02T14:38:07.852618Z"}],"nvd":[{"id":"CVE-2021-39160","description":"nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.","status":"published","published":"2021-08-25T18:15:08.487Z","modified":"2026-06-17T04:03:13.217Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94","CWE-78"],"updated_at":"2026-11-02T14:06:57.67549Z"}],"osv":[{"id":"CVE-2021-39160","description":"nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.","status":"published","published":"2021-08-25T18:15:08.487Z","modified":"2026-10-20T10:54:53.706436467Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"GHSA-mq5p-2mcr-m52j","title":"Code injection in nbgitpuller","description":"### Impact\n\nDue to an unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment.\n\n### Patches\n\n0.10.2\n\n### Workarounds\n\nNone, other than upgrade to 0.10.2 or downgrade to 0.8.x.\n\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [nbgitpuller](https://github.com/jupyterhub/nbgitpuller/issues)\n* Email our security team at [security@ipython.org](mailto:security@ipython.org)\n","status":"published","published":"2021-08-30T16:17:06Z","modified":"2026-07-08T06:28:22.586401887Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78","CWE-94"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"PYSEC-2021-315","description":"nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.","status":"published","published":"2021-08-25T18:15:00Z","modified":"2023-11-08T04:06:31.649485Z","updated_at":"2026-11-02T15:52:52.682031Z"}]}}