p PatchFirst

CVE-2025-30370

CVE-2025-30370 · jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. This vulnerability is fixed in 0.51.1.

CVSS 7.4 · Alta · EPSS 0,6% · Corrección disponible

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • jupyterlab-git

    Versiones
    • < 0.51.1: Afectada

    Sin corrección publicada

  • jupyterlab-git PyPI

    Versiones
    • 0.1.1
    • 0.1.2
    • 0.10.0
    • 0.10.1
    • 0.10.1rc0
    • 0.11.0
    • 0.11.0rc0
    • 0.11.0rc1
    • 0.2.0
    • 0.2.2
    • 0.20.0
    • 0.20.0rc0
    • 0.21.0
    • 0.21.0a0
    • 0.21.0a1
    • 0.21.0rc0
    • 0.21.1
    • 0.22.0
    • 0.22.1
    • 0.22.2
    • 0.22.3
    • 0.23.0
    • 0.23.1
    • 0.23.2
    • 0.23.3
    • 0.24.0
    • 0.3.0
    • 0.30.0
    • 0.30.0b1
    • 0.30.0b2
    • 0.30.0b3
    • 0.30.1
    • 0.31.0
    • 0.31.0a0
    • 0.32.0
    • 0.32.1
    • 0.32.2
    • 0.32.3
    • 0.32.4
    • 0.33.0
    • 0.34.0
    • 0.34.1
    • 0.34.2
    • 0.35.0
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.38.0
    • 0.39.0
    • 0.39.1
    • 0.39.2
    • 0.39.3
    • 0.4.4
    • 0.40.0
    • 0.40.1
    • 0.41.0
    • 0.42.0
    • 0.42.0rc0
    • 0.43.0
    • 0.44.0
    • 0.5.0
    • 0.50.0
    • 0.50.0a0
    • 0.50.0a1
    • 0.50.0a2
    • 0.50.0rc0
    • 0.50.1
    • 0.50.2
    • 0.51.0
    • 0.6.0
    • 0.6.1
    • 0.8.0
    • 0.8.1
    • 0.9.0
    • 0.9.0rc1
    • 0.9.1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 0.51.1

    Actualiza a 0.51.1

Fuentes originales

Comprueba tu servidor →