---
id: CVE-2021-39160
aliases:
  - GHSA-mq5p-2mcr-m52j
  - PYSEC-2021-315
title: Code injection in nbgitpuller
summary: Code injection in nbgitpuller
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
vendor: nbgitpuller
product: nbgitpuller
ecosystem: pip
affected:
  - 'nbgitpuller >= 0.9.0, < 0.10.2'
patched:
  - nbgitpuller 0.10.2
published: '2021-08-30'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-mq5p-2mcr-m52j'
references:
  - url: >-
      https://github.com/jupyterhub/nbgitpuller/security/advisories/GHSA-mq5p-2mcr-m52j
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-39160'
  - url: >-
      https://github.com/jupyterhub/nbgitpuller/commit/07690644f29a566011dd0d7ba14cae3eb0490481
  - url: 'https://github.com/jupyterhub/nbgitpuller'
  - url: >-
      https://github.com/jupyterhub/nbgitpuller/blob/main/CHANGELOG.md#0102---2021-08-25
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/nbgitpuller/PYSEC-2021-315.yaml
tags:
  - osv
  - pip
epss: 0.0173
epssPercentile: 0.76636
ingestedAt: '2026-07-08T18:25:51.403Z'
---

## Overview

### Impact

Due to an unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment.

### Patches

0.10.2

### Workarounds

None, other than upgrade to 0.10.2 or downgrade to 0.8.x.


### For more information

If you have any questions or comments about this advisory:

* Open an issue in [nbgitpuller](https://github.com/jupyterhub/nbgitpuller/issues)
* Email our security team at [security@ipython.org](mailto:security@ipython.org)


## Affected packages

- `nbgitpuller >= 0.9.0, < 0.10.2`

## Remediation

Upgrade to a patched release:

- `nbgitpuller 0.10.2`