---
id: CVE-2024-21624
aliases:
  - GHSA-59j8-776v-xxxg
  - PYSEC-2024-37
title: NoneBot Potential Information Leak in User-Constructed Message Templates
summary: NoneBot Potential Information Leak in User-Constructed Message Templates
severity: medium
cvss: 5.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N'
vendor: nonebot2
product: nonebot2
ecosystem: pip
affected:
  - 'nonebot2 >= 2.0.0a16, < 2.2.0'
patched:
  - nonebot2 2.2.0
published: '2024-02-09'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:05.511545008Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-59j8-776v-xxxg'
references:
  - url: >-
      https://github.com/nonebot/nonebot2/security/advisories/GHSA-59j8-776v-xxxg
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-21624'
  - url: 'https://github.com/nonebot/nonebot2/pull/2509'
  - url: >-
      https://github.com/nonebot/nonebot2/commit/b65b3b438c95894654fd9081139989c757bdc6c1
  - url: 'https://github.com/nonebot/nonebot2'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/nonebot2/PYSEC-2024-37.yaml
tags:
  - osv
  - pip
epss: 0.00492
epssPercentile: 0.39671
ingestedAt: '2026-09-12T03:13:01.659Z'
---

## Overview

### Impact
This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates.

### Patches
The identified vulnerability has been remedied in fix #2509 and will be included in versions released after 2.1.3. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability.

### Workarounds
A temporary workaround involves filtering underscores before incorporating user input into the message template.

### References
- [Pull Request #2509](https://github.com/nonebot/nonebot2/pull/2509)
- [CWE-1336](https://cwe.mitre.org/data/definitions/1336.html)

## Affected packages

- `nonebot2 >= 2.0.0a16, < 2.2.0`

## Remediation

Upgrade to a patched release:

- `nonebot2 2.2.0`