Critical · published October 26, 2020
🚨 A rogue markdown could trigger malicious shell commands to run automatically! This vulnerability in lookatme versions before 2.3.0 is a critical concern for anyone rendering untrusted markdown. 🔥 Think of it like a restaurant serving a dish you didn’t order, but they secretly include a surprise ingredient that activates a firework show in your kitchen — unexpected and potentially disastrous! An unsuspecting user rendering untrusted markdown could have malicious commands executed on their system, leading to unauthorized access or data loss. This is absolutely devastating if sensitive information is at risk or if a system becomes compromised!
Think of it like a restaurant serving a dish you didn’t order, but they secretly include a surprise ingredient that activates a firework show in your kitchen — unexpected and potentially disastrous! This vulnerability allows automatic loading of extensions in the lookatme Python package, specifically the 'terminal' and 'file_loader' extensions, which can execute commands without any user consent when untrusted markdown is rendered.
An unsuspecting user rendering untrusted markdown could have malicious commands executed on their system, leading to unauthorized access or data loss. This is absolutely devastating if sensitive information is at risk or if a system becomes compromised! Immediately upgrade lookatme to version 2.3.0 to eliminate this risk. If upgrading isn't possible, consider manually deleting the 'terminal.py' and 'file_loader.py' files to prevent automatic execution. Always review markdown content before rendering! You've got this! Follow these steps, and you'll keep your environment secure! 🛡️