id: PYSEC-2020-61
details: In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically
  loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme
  to render untrusted markdown may have malicious shell commands automatically run
  on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py`
  and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally,
  it is always recommended to be aware of what is being rendered with lookatme.
affected:
- package:
    name: lookatme
    ecosystem: PyPI
    purl: pkg:pypi/lookatme
  ranges:
  - type: GIT
    repo: https://github.com/d0c-s4vage/lookatme
    events:
    - introduced: "0"
    - fixed: 72fe36b784b234548d49dae60b840c37f0eb8d84
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.3.0
  versions:
  - 0.0.2
  - 0.1.0
  - 0.1.1
  - 0.2.0
  - 0.3.0
  - 0.4.0
  - 0.5.0
  - 1.0.0
  - 1.0.1
  - 1.1.0
  - 1.1.1
  - 1.2.0
  - 1.2.1
  - 1.3.0
  - 2.0.0
  - 2.1.0
  - 2.2.0
references:
- type: ADVISORY
  url: https://github.com/d0c-s4vage/lookatme/security/advisories/GHSA-c84h-w6cr-5v8q
- type: FIX
  url: https://github.com/d0c-s4vage/lookatme/commit/72fe36b784b234548d49dae60b840c37f0eb8d84
- type: PACKAGE
  url: https://pypi.org/project/lookatme/#history
- type: WEB
  url: https://github.com/d0c-s4vage/lookatme/releases/tag/v2.3.0
- type: WEB
  url: https://github.com/d0c-s4vage/lookatme/pull/110
aliases:
- CVE-2020-15271
- GHSA-c84h-w6cr-5v8q
modified: "2020-11-13T16:40:00Z"
published: "2020-10-26T18:15:00Z"