CVE-2024-21624

    Dashboard / Vulnerabilities / CVE-2024-21624

    CVE-2024-21624

    Published: 9 Feb 2024Last Modified: 28 Oct 2026

    Summary: Potential Information Leak in User-Constructed Message Templates in nonebot2

    Details: nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21624.json, https://github.com/nonebot/nonebot2/security/advisories/GHSA-59j8-776v-xxxg, https://nvd.nist.gov/vuln/detail/CVE-2024-21624, https://github.com/nonebot/nonebot2/pull/2509

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- f2b0b1752b840dc70d14641e82a98465f912d7dd
    Fixed -35cee22cf67b2538fc7cb86c8804ef8eb8eb2bbc

    Affected versions

    2.0.0-NA
    2.0.0-rc2
    2.0.0-rc3
    2.0.0-rc4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High