CVE-2024-21624
- Source
- https://cve.org/CVERecord?id=CVE-2024-21624
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-21624.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-21624
- Aliases
- Published
- 2024-02-09T22:16:49.974Z
- Modified
- 2026-07-08T08:12:36.027416015Z
- Severity
-
- 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Potential Information Leak in User-Constructed Message Templates in nonebot2
- Details
-
nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize
MessageTemplateand incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template. - Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21624.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-200" ] }- References
Affected packages
Git / github.com/nonebot/nonebot2
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nonebot/nonebot2
- Events
-
IntroducedFixedIntroduced
- Database specific
{ "source": [ "CPE_RANGE", "CPE_STRING" ], "cpe": [ "cpe:2.3:a:nonebot:nonebot:*:*:*:*:*:*:*:*", "cpe:2.3:a:nonebot:nonebot:2.0.0:-:*:*:*:*:*:*", "cpe:2.3:a:nonebot:nonebot:2.0.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:nonebot:nonebot:2.0.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:nonebot:nonebot:2.0.0:rc4:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "2.0.1" }, { "fixed": "2.2.0" }, { "introduced": "2.0.0-NA" }, { "last_affected": "2.0.0-NA" }, { "introduced": "2.0.0-rc2" }, { "last_affected": "2.0.0-rc2" }, { "introduced": "2.0.0-rc3" }, { "last_affected": "2.0.0-rc3" }, { "introduced": "2.0.0-rc4" }, { "last_affected": "2.0.0-rc4" } ] }