AVID-2026-R0884

Description

Code injection in nbgitpuller (CVE-2021-39160)

Details

nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.

Reason for inclusion in AVID: CVE-2021-39160 describes a code injection vulnerability in nbgitpuller, a Jupyter server extension that can be used in AI/ML workflows to fetch code from Git repositories. The flaw arises from unsanitized input and can lead to arbitrary code execution in the user environment, which is a security vulnerability with high impact. nbgitpuller is a software component commonly used in AI development/deployment stacks (Jupyter-based workflows, notebooks, and CI/CD within AI labs), thus it is part of the software supply chain for general-purpose AI systems. The advisory includes remediation (upgrade to 0.10.2) and CVSS 3.1 score (9.6), providing sufficient evidence of the vulnerability and its impact.

References

Affected or Relevant Artifacts

Developer: jupyterhub
Deployer: jupyterhub
Artifact Details:

Type	Name
System	nbgitpuller

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Base Score	9.6
Base Severity	🔴 Critical
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	NONE
User Interaction	REQUIRED
Scope	CHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🔴 High
Availability Impact	🔴 High

CWE

ID	Description
CWE-94	CWE-94: Improper Control of Generation of Code (‘Code Injection’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2021-08-25
Version: 0.3.3
AVID Entry