CVE-2021-39160

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-78

Affected software

Vendor	Product	Versions
jupyterhub	nbgitpuller	>= 0.9.0, < 0.10.2

References

https://github.com/jupyterhub/nbgitpuller/blob/main/CHANGELOG.md#0102---2021-08-25Release Notes, Third Party Advisory
https://github.com/jupyterhub/nbgitpuller/commit/07690644f29a566011dd0d7ba14cae3eb0490481Patch, Third Party Advisory
https://github.com/jupyterhub/nbgitpuller/security/advisories/GHSA-mq5p-2mcr-m52jThird Party Advisory
https://github.com/jupyterhub/nbgitpuller/blob/main/CHANGELOG.md#0102---2021-08-25Release Notes, Third Party Advisory
https://github.com/jupyterhub/nbgitpuller/commit/07690644f29a566011dd0d7ba14cae3eb0490481Patch, Third Party Advisory
https://github.com/jupyterhub/nbgitpuller/security/advisories/GHSA-mq5p-2mcr-m52jThird Party Advisory

Timeline

Published: Aug 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-391615.4Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scripting(XSS)CVE-2021-391628.6Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SET CVE-2021-391633.1Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access t CVE-2021-391643.1Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access t CVE-2021-391656.5Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#s CVE-2021-391665.4Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before print CVE-2021-391679.8OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with th CVE-2021-391689.8OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with th CVE-2021-391695.4Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in CVE-2021-39175.5A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. T CVE-2021-391705.4Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a valu CVE-2021-391717.5Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SA