In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
| Link | Tags |
|---|---|
| https://github.com/d0c-s4vage/lookatme/security/advisories/GHSA-c84h-w6cr-5v8q | third party advisory |
| https://github.com/d0c-s4vage/lookatme/pull/110 | third party advisory exploit |
| https://github.com/d0c-s4vage/lookatme/commit/72fe36b784b234548d49dae60b840c37f0eb8d84 | third party advisory patch |
| https://github.com/d0c-s4vage/lookatme/releases/tag/v2.3.0 | third party advisory release notes |
| https://pypi.org/project/lookatme/#history | third party advisory release notes |