PyPI: bikeshed
CVE-2021-23422
Safety vulnerability ID: SFTY-20210816-22134
Safety legacy ID: pyup.io-41179
Bikeshed version 3.0.0 includes a fix for CVE-2021-23422: When an untrusted source file containing Inline Tag Command metadata is processed or when an arbitrary OS command is executed, the command output would be included in the HTML output. https://github.com/tabatkins/bikeshed/commit/b2f668fca204260b1cad28d5078e93471cb6b2dd
Overview
OS Command Injection in bikeshed
Advisory
Bikeshed version 3.0.0 includes a fix for CVE-2021-23422: When an untrusted source file containing Inline Tag Command metadata is processed or when an arbitrary OS command is executed, the command output would be included in the HTML output. https://github.com/tabatkins/bikeshed/commit/b2f668fca204260b1cad28d5078e93471cb6b2dd
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20210816-22134/CVE-2021-23422
- https://nvd.nist.gov/vuln/detail/CVE-2021-23422
- https://github.com/tabatkins/bikeshed/commit/b2f668fca204260b1cad28d5078e93471cb6b2dd
- https://snyk.io/vuln/SNYK-PYTHON-BIKESHED-1537646
- https://github.com/pypa/advisory-database/tree/main/vulns/bikeshed/PYSEC-2021-116.yaml
- https://github.com/advisories/GHSA-87cj-px37-rc3x
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more