id: PYSEC-2018-76
details: 'topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse,
  file topydo/lib/ListFormat.py line 292 as of d4f843dac71308b2f29a7c2cdc76f055c3841523
  that can result in Injection of arbitrary bytes to the terminal, including terminal
  escape code sequences. This attack appear to be exploitable via The victim must
  open a todo.txt with at least one specially crafted line..'
affected:
- package:
    name: topydo
    ecosystem: PyPI
    purl: pkg:pypi/topydo
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
  versions:
  - '0.1'
  - 0.1.1
  - 0.1.2
  - '0.10'
  - 0.10.1
  - '0.11'
  - '0.12'
  - '0.13'
  - '0.14'
  - '0.2'
  - '0.3'
  - 0.3.1
  - 0.3.2
  - '0.4'
  - 0.4.1
  - '0.5'
  - '0.6'
  - '0.7'
  - '0.8'
  - '0.9'
references:
- type: REPORT
  url: https://github.com/bram85/topydo/issues/240
- type: WEB
  url: https://github.com/bram85/topydo/blob/master/topydo/lib/ListFormat.py#L292
- type: ADVISORY
  url: https://github.com/advisories/GHSA-h6h9-pphv-m266
aliases:
- CVE-2018-1000523
- GHSA-h6h9-pphv-m266
modified: '2021-08-25T04:30:33.312157Z'
published: '2018-06-26T16:29:00Z'