PYSEC-2021-116

Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/bikeshed/PYSEC-2021-116.yaml
Aliases
Published
2021-08-16T08:15:00Z
Modified
2023-11-08T04:05:08.743769Z
Details

This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output.

References

Affected packages

PyPI / bikeshed

Package

Name
bikeshed

Affected ranges

Type
GIT
Repo
https://github.com/tabatkins/bikeshed
Events
Introduced
0The exact introduced commit is unknown
Fixed
b2f668fca204260b1cad28d5078e93471cb6b2dd
Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
3.0.0

Affected versions

1.*

1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.1.0
1.2.0
1.2.1
1.2.2
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.6.0
1.6.1
1.6.2
1.6.3
1.7.0

2.*

2.0.0
2.1.0
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7