id: PYSEC-2021-315
details: nbgitpuller is a Jupyter server extension to sync a git repository one-way
  to a local path. Due to unsanitized input, visiting maliciously crafted links could
  result in arbitrary code execution in the user environment. This has been resolved
  in version 0.10.2 and all users are advised to upgrade. No work around exist for
  users who can not upgrade.
affected:
- package:
    name: nbgitpuller
    ecosystem: PyPI
    purl: pkg:pypi/nbgitpuller
  ranges:
  - type: GIT
    repo: https://github.com/jupyterhub/nbgitpuller
    events:
    - introduced: "0"
    - fixed: 07690644f29a566011dd0d7ba14cae3eb0490481
  - type: ECOSYSTEM
    events:
    - introduced: 0.9.0
    - fixed: 0.10.2
  versions:
  - 0.10.0
  - 0.10.1
  - 0.9.0
references:
- type: WEB
  url: https://github.com/jupyterhub/nbgitpuller/blob/main/CHANGELOG.md#0102---2021-08-25
- type: ADVISORY
  url: https://github.com/jupyterhub/nbgitpuller/security/advisories/GHSA-mq5p-2mcr-m52j
- type: FIX
  url: https://github.com/jupyterhub/nbgitpuller/commit/07690644f29a566011dd0d7ba14cae3eb0490481
aliases:
- CVE-2021-39160
- GHSA-mq5p-2mcr-m52j
modified: "2021-08-30T18:40:30.558311Z"
published: "2021-08-25T18:15:00Z"