p PatchFirst

CVE-2025-30370

CVE-2025-30370 · jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. This vulnerability is fixed in 0.51.1.

CVSS 7.4 · Élevée · EPSS 0,6% · Correctif disponible

Publication
Mise à jour

Pile logicielle: python

Produits et versions concernés

  • jupyterlab-git

    Versions du logiciel
    • < 0.51.1: Concernée

    Aucun correctif publié

  • jupyterlab-git PyPI

    Versions du logiciel
    • 0.1.1
    • 0.1.2
    • 0.10.0
    • 0.10.1
    • 0.10.1rc0
    • 0.11.0
    • 0.11.0rc0
    • 0.11.0rc1
    • 0.2.0
    • 0.2.2
    • 0.20.0
    • 0.20.0rc0
    • 0.21.0
    • 0.21.0a0
    • 0.21.0a1
    • 0.21.0rc0
    • 0.21.1
    • 0.22.0
    • 0.22.1
    • 0.22.2
    • 0.22.3
    • 0.23.0
    • 0.23.1
    • 0.23.2
    • 0.23.3
    • 0.24.0
    • 0.3.0
    • 0.30.0
    • 0.30.0b1
    • 0.30.0b2
    • 0.30.0b3
    • 0.30.1
    • 0.31.0
    • 0.31.0a0
    • 0.32.0
    • 0.32.1
    • 0.32.2
    • 0.32.3
    • 0.32.4
    • 0.33.0
    • 0.34.0
    • 0.34.1
    • 0.34.2
    • 0.35.0
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.38.0
    • 0.39.0
    • 0.39.1
    • 0.39.2
    • 0.39.3
    • 0.4.4
    • 0.40.0
    • 0.40.1
    • 0.41.0
    • 0.42.0
    • 0.42.0rc0
    • 0.43.0
    • 0.44.0
    • 0.5.0
    • 0.50.0
    • 0.50.0a0
    • 0.50.0a1
    • 0.50.0a2
    • 0.50.0rc0
    • 0.50.1
    • 0.50.2
    • 0.51.0
    • 0.6.0
    • 0.6.1
    • 0.8.0
    • 0.8.1
    • 0.9.0
    • 0.9.0rc1
    • 0.9.1
    Plages de versions concernées
    • ECOSYSTEM: < 0.51.1

    Mettez à jour vers 0.51.1

Sources originales

Vérifiez votre serveur →