CVE catalog

CVE-2020-15271

lookatme: CVE-2020-15271

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
2.31% · Oct 25, 2026

In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlookatmesid2.5.4-3fixed
Debianlookatmeforky2.5.4-3fixed
Debianlookatmetrixie2.5.4-3fixed
Debianlookatmebookworm2.5.4-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlookatmesourcesid2.3.0-1not yet assignedNot reported[972988]
Debianlookatmesourceforky2.3.0-1not yet assignedNot reported[972988]
Debianlookatmesourcetrixie2.3.0-1not yet assignedNot reported[972988]
Debianlookatmesourcebookworm2.3.0-1not yet assignedNot reported[972988]

[Debian bug #972988]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [lookatme]Fixed
    Details (2)

    • 2.5.4-1 · all · bookworm

      Fixed · Fixed: 2.3.0-1

      dsa · lookatme · debian · bookworm; dsa · lookatme · debian · 12

    • 2.5.4-1 · all · bookworm

      Fixed · Fixed: 2.3.0-1

      dsa · lookatme · debian · bookworm; dsa · lookatme · debian · 12

[Debian 13 (Trixie)]

  • [lookatme]Fixed
    Details (2)

    • 2.5.4-3 · all · trixie

      Fixed · Fixed: 2.3.0-1

      dsa · lookatme · debian · 13

    • 2.5.4-3 · all · trixie

      Fixed · Fixed: 2.3.0-1

      dsa · lookatme · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]