Vulnerability · Published Feb 9, 2024 · Assigned by GitHub_M
CVE-2024-21624Potential Information Leak in User-Constructed Message Templates in nonebot2
Medium 5.7
In plain English
A medium-severity information exposure in nonebot2 from nonebot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | nonebot2 | 2.2.0 | GHSA-59j8-776v-xxxg |
| PyPI | nonebot2 | 2.2.0 | PYSEC-2024-37 |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
References
- https://github.com/nonebot/nonebot2/security/advisories/GHSA-59j8-776v-xxxg x_refsource_CONFIRM
- https://github.com/nonebot/nonebot2/pull/2509 x_refsource_MISC