{"id":"CVE-2024-21624","aliases":["EUVD-2024-0119","GHSA-59j8-776v-xxxg","PYSEC-2024-37"],"status":"published","title":"Potential Information Leak in User-Constructed Message Templates in nonebot2","description":"nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00492,"percentile":0.42761,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1336","CWE-200"],"published":"2024-02-09T15:04:08Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"PyPI","package":"nonebot2","fixed_in":["2.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"nonebot2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0a16"},{"last_affected":"2.1.3"},{"fixed":"2.2.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"nonebot2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0a16"},{"fixed":"2.2.0"}]}],"versions":["2.0.0","2.0.0a16","2.0.0b1","2.0.0b2","2.0.0b3","2.0.0b4","2.0.0b5","2.0.0rc1","2.0.0rc2","2.0.0rc3","2.0.0rc4","2.0.1","2.1.0","2.1.1","2.1.2","2.1.3"]},{"source":"osv","ecosystem":"PyPI","package":"nonebot2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.1"},{"fixed":"2.2.0"}]}],"versions":["2.0.1","2.1.0","2.1.1","2.1.2","2.1.3"]}],"products":[{"vendor":"nonebot","product":"nonebot"},{"vendor":"nonebot","product":"nonebot2"}],"references":[{"url":"https://github.com/nonebot/nonebot2/security/advisories/GHSA-59j8-776v-xxxg","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/nonebot/nonebot2/pull/2509","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/nonebot/nonebot2/commit/b65b3b438c95894654fd9081139989c757bdc6c1","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21624","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/nonebot2/PYSEC-2024-37.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-59j8-776v-xxxg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21624.json","tags":["advisory"]},{"url":"https://github.com/nonebot/nonebot2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-21624","title":"Potential Information Leak in User-Constructed Message Templates in nonebot2","description":"nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.","status":"published","published":"2024-02-09T22:16:49.974Z","modified":"2024-08-01T22:27:35.692Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:05.077718Z"}],"euvd":[{"id":"EUVD-2024-0119","description":"nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.","status":"published","published":"2024-02-09T22:16:49Z","modified":"2024-08-01T22:27:35Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:29.983832Z"}],"ghsa":[{"id":"GHSA-59j8-776v-xxxg","title":"NoneBot Potential Information Leak in User-Constructed Message Templates","description":"### Impact\nThis security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates.\n\n### Patches\nThe identified vulnerability has been remedied in fix #2509 and will be included in versions released after 2.1.3. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability.\n\n### Workarounds\nA temporary workaround involves filtering underscores before incorporating user input into the message template.\n\n### References\n- [Pull Request #2509](https://github.com/nonebot/nonebot2/pull/2509)\n- [CWE-1336](https://cwe.mitre.org/data/definitions/1336.html)","status":"published","published":"2024-02-09T15:04:08Z","modified":"2024-02-16T22:31:38Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-1336"],"updated_at":"2026-11-02T14:37:38.20753Z"}],"nvd":[{"id":"CVE-2024-21624","description":"nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.","status":"published","published":"2024-02-09T23:15:08.553Z","modified":"2026-06-17T07:09:52.123Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:09:35.738752Z"}],"osv":[{"id":"CVE-2024-21624","title":"Potential Information Leak in User-Constructed Message Templates in nonebot2","description":"nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.","status":"published","published":"2024-02-09T22:16:49.974Z","modified":"2026-10-28T02:31:05.229187398Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"GHSA-59j8-776v-xxxg","title":"NoneBot Potential Information Leak in User-Constructed Message Templates","description":"### Impact\nThis security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates.\n\n### Patches\nThe identified vulnerability has been remedied in fix #2509 and will be included in versions released after 2.1.3. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability.\n\n### Workarounds\nA temporary workaround involves filtering underscores before incorporating user input into the message template.\n\n### References\n- [Pull Request #2509](https://github.com/nonebot/nonebot2/pull/2509)\n- [CWE-1336](https://cwe.mitre.org/data/definitions/1336.html)","status":"published","published":"2024-02-09T15:04:08Z","modified":"2026-09-10T03:50:05.511545008Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-1336","CWE-200"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"PYSEC-2024-37","description":"nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.","status":"published","published":"2024-02-09T23:15:00Z","modified":"2024-02-16T16:41:43.954924Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:54.242332Z"}]}}