Vulnerability · Published Jun 3, 2022 · Assigned by snyk
CVE-2022-24065Command Injection
High 8.1
In plain English
A high-severity security flaw in cookiecutter. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.2% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)4.2%top 9.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | cookiecutter | no fix listed | DEBIAN-CVE-2022-24065 |
| Debian:13 | cookiecutter | 2.6.0-1 | DEBIAN-CVE-2022-24065 |
| Debian:14 | cookiecutter | 2.6.0-1 | DEBIAN-CVE-2022-24065 |
| PyPI | cookiecutter | 2.1.1 | PYSEC-2022-204 |
| PyPI | cookiecutter | 2.1.1 | GHSA-f4q6-9qm4-h8j4 |
| Ubuntu:22.04:LTS | cookiecutter | no fix listed | UBUNTU-CVE-2022-24065 |
| Ubuntu:24.04:LTS | cookiecutter | no fix listed | UBUNTU-CVE-2022-24065 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | cookiecutter | unspecified – before 2.1.1 |
References
- https://snyk.io/vuln/SNYK-PYTHON-COOKIECUTTER-2414281 x_refsource_MISC
- https://github.com/cookiecutter/cookiecutter/releases/tag/2.1.1 x_refsource_MISC
- https://github.com/cookiecutter/cookiecutter/commit/fdffddb31fd2b46344dfa317531ff155e7999f77 x_refsource_MISC
- FEDORA-2022-ff1c98b2fe vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-4a3d83a1d2 vendor-advisory, x_refsource_FEDORA