CVE-2020-15271

In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.

• CWE-78
• CWE-78

• https://github.com/d0c-s4vage/lookatme/commit/72fe36b784b234548d49dae60b840c37f0eb8d84Patch, Third Party Advisory
• https://github.com/d0c-s4vage/lookatme/pull/110Exploit, Third Party Advisory
• https://github.com/d0c-s4vage/lookatme/releases/tag/v2.3.0Release Notes, Third Party Advisory
• https://github.com/d0c-s4vage/lookatme/security/advisories/GHSA-c84h-w6cr-5v8qThird Party Advisory
• https://pypi.org/project/lookatme/#historyRelease Notes, Third Party Advisory
• https://github.com/d0c-s4vage/lookatme/commit/72fe36b784b234548d49dae60b840c37f0eb8d84Patch, Third Party Advisory
• https://github.com/d0c-s4vage/lookatme/pull/110Exploit, Third Party Advisory
• https://github.com/d0c-s4vage/lookatme/releases/tag/v2.3.0Release Notes, Third Party Advisory
• https://github.com/d0c-s4vage/lookatme/security/advisories/GHSA-c84h-w6cr-5v8qThird Party Advisory
• https://pypi.org/project/lookatme/#historyRelease Notes, Third Party Advisory

Published

Oct 26, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15264The Boxstarter installer before version 2.13.0 configures C:…7.8
• CVE-2020-15265In Tensorflow before version 2.4.0, an attacker can pass an …7.5
• CVE-2020-15266In Tensorflow before version 2.4.0, when the `boxes` argumen…7.5
• CVE-2020-15269In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired u…9.1
• CVE-2020-1527An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15270Parse Server (npm package parse-server) broadcasts events to…4.3
• CVE-2020-15272In the git-tag-annotation-action (open source GitHub Action)…9.6
• CVE-2020-15273baserCMS before version 4.4.1 is vulnerable to Cross-Site Sc…8.1
• CVE-2020-15274In Wiki.js before version 2.5.162, an XSS payload can be inj…5.4
• CVE-2020-15275MoinMoin is a wiki engine. In MoinMoin before version 1.9.11…5.4
• CVE-2020-15276baserCMS before version 4.4.1 is vulnerable to Cross-Site Sc…8.7
• CVE-2020-15277baserCMS before version 4.4.1 is affected by Remote Code Exe…7.2