CVE-2024-21624

nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.

• CWE-200

• https://github.com/nonebot/nonebot2/pull/2509Issue Tracking, Patch
• https://github.com/nonebot/nonebot2/security/advisories/GHSA-59j8-776v-xxxgVendor Advisory
• https://github.com/nonebot/nonebot2/pull/2509Issue Tracking, Patch
• https://github.com/nonebot/nonebot2/security/advisories/GHSA-59j8-776v-xxxgVendor Advisory

Published

Feb 9, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21618An Access of Memory Location After End of Buffer vulnerabili…7.1
• CVE-2024-21619A Missing Authentication for Critical Function vulnerability…7.5
• CVE-2024-2162An OS Command Injection vulnerability in Kiloview NDI allows…8.8
• CVE-2024-21620An Improper Neutralization of Input During Web Page Generati…6.1
• CVE-2024-21622Craft is a content management system. This is a potential mo…8.8
• CVE-2024-21623OTCLient is an alternative tibia client for otserv. Prior to…9.8
• CVE-2024-21625SideQuest is a place to get virtual reality applications for…8.8
• CVE-2024-21626runc is a CLI tool for spawning and running containers on Li…8.6
• CVE-2024-21627PrestaShop is an open-source e-commerce platform. Prior to v…6.1
• CVE-2024-21628PrestaShop is an open-source e-commerce platform. Prior to v…6.1
• CVE-2024-21629Rust EVM is an Ethereum Virtual Machine interpreter. In `rus…7.5
• CVE-2024-2163The Ninja Beaver Add-ons for Beaver Builder plugin for WordP…6.4