CVE-2024-21624 Information

Description

nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g. environment variables) in instances where developers utilize MessageTemplate and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request 2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.

Reference

https://github.com/nonebot/nonebot2/security/advisories/GHSA-59j8-776v-xxxg https://github.com/nonebot/nonebot2/pull/2509