GHSA-h6h9-pphv-m266

Source

https://github.com/advisories/GHSA-h6h9-pphv-m266

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/09/GHSA-h6h9-pphv-m266/GHSA-h6h9-pphv-m266.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h6h9-pphv-m266

Aliases

Published

2018-09-13T15:47:26Z

Modified

2024-11-13T23:02:15.075182Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVSS Calculator
8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Topydo Improper Input Validation vulnerability

Details

topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of d4f843dac71308b2f29a7c2cdc76f055c3841523 that can result in Injection of arbitrary bytes to the terminal, including terminal escape code sequences. This attack appear to be exploitable via The victim must open a todo.txt with at least one specially crafted line.

Database specific

{
    "github_reviewed": true,
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-20"
    ],
    "github_reviewed_at": "2020-06-16T21:39:06Z",
    "severity": "HIGH"
}

References

Affected packages

PyPI / topydo

Package

Name: topydo; View open source insights on deps.dev
Purl: pkg:pypi/topydo

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.13

Affected versions

0.*

0.1

0.1.1

0.1.2

0.2

0.3

0.3.1

0.3.2

0.4

0.4.1

0.5

0.6

0.7

0.8

0.9

0.10

0.10.1

0.11

0.12

0.13

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/09/GHSA-h6h9-pphv-m266/GHSA-h6h9-pphv-m266.json"