PyPI/binderhub CVE-2021-39159: critical 9.6, EPSS 1.93%

remote code execution via git repo provider

Action: Upgrade binderhub to 0.2.0 or later.

pip install binderhub==0.2.0

Affected

Fixed versions

Sources

• osv: GHSA-9jjr-qqfp-ppwx
• https://github.com/jupyterhub/binderhub/security/advisories/GHSA-9jjr-qqfp-ppwx
• https://nvd.nist.gov/vuln/detail/CVE-2021-39159
• https://github.com/jupyterhub/binderhub/commit/195caac172690456dcdc8cc7a6ca50e05abf8182
• https://github.com/jupyterhub/binderhub/commit/195caac172690456dcdc8cc7a6ca50e05abf8182.patch
• https://github.com/jupyterhub/binderhub
• https://github.com/pypa/advisory-database/tree/main/vulns/binderhub/PYSEC-2021-371.yaml

CVE-2021-39159 · published 2021-08-30T16:16:58Z · modified 2026-07-08T06:28:25.928249952Z · JSON