id: PYSEC-2024-37
modified: 2024-02-16T16:22:37.389642Z
published: 2024-02-09T23:15:00Z
aliases:
- CVE-2024-21624
- GHSA-59j8-776v-xxxg
details: 'nonebot2 is a cross-platform Python asynchronous chatbot framework written
  in Python. This security advisory pertains to a potential information leak (e.g.,
  environment variables) in instances where developers utilize `MessageTemplate` and
  incorporate user-provided data into templates. The identified vulnerability has
  been remedied in pull request #2509 and will be included in versions released from
  2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard
  against the vulnerability. A temporary workaround involves filtering underscores
  before incorporating user input into the message template.'
affected:
- package:
    ecosystem: PyPI
    name: nonebot2
    purl: pkg:pypi/nonebot2
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 2.0.1
    - fixed: 2.2.0
  versions:
  - 2.0.1
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.3
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
references:
- type: ADVISORY
  url: https://github.com/nonebot/nonebot2/security/advisories/GHSA-59j8-776v-xxxg
- type: REPORT
  url: https://github.com/nonebot/nonebot2/pull/2509
- type: FIX
  url: https://github.com/nonebot/nonebot2/pull/2509