What is GHSA-h6h9-pphv-m266?

GHSA-h6h9-pphv-m266 is a security advisory published by GitHub Security Advisories with High severity. Topydo Improper Input Validation vulnerability

Which CVE IDs does GHSA-h6h9-pphv-m266 cover?

GHSA-h6h9-pphv-m266 covers the following CVE IDs: CVE-2018-1000523. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h6h9-pphv-m266?

GHSA-h6h9-pphv-m266 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-h6h9-pphv-m266?

GHSA-h6h9-pphv-m266 affects 1 product, including: pip/topydo:\u003c= 0.13.

GHSA-h6h9-pphv-m266HighCVSS 8.1

Topydo Improper Input Validation vulnerability

Vendor

GitHub Security Advisories

Published

September 13, 2018

Last Modified

November 13, 2024

🔗 CVE IDs covered (1)

CVE-2018-1000523 →

📋 Description

topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of d4f843dac71308b2f29a7c2cdc76f055c3841523 that can result in Injection of arbitrary bytes to the terminal, including terminal escape code sequences. This attack appear to be exploitable via The victim must open a todo.txt with at least one specially crafted line.

🎯 Affected products1

pip/topydo:<= 0.13

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000523
https://github.com/bram85/topydo/issues/240
https://github.com/advisories/GHSA-h6h9-pphv-m266
https://github.com/bram85/topydo/blob/master/topydo/lib/ListFormat.py#L292
https://github.com/pypa/advisory-database/tree/main/vulns/topydo/PYSEC-2018-76.yaml