HIGH7.5

PYSEC-2021-878

Quick fix

PYSEC-2021-878 — mkdocs: upgrade to the fixed version with the command below.

pip install --upgrade 'mkdocs>=1.2.3'

Details

The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://github.com/nisdn/CVE-2021-40978/issues/1

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/mkdocs

Introduced in: 1.2.2Fixed in: 1.2.3

Fixpip install --upgrade 'mkdocs>=1.2.3'

References

https://github.com/nisdn/CVE-2021-40978[EVIDENCE]
https://github.com/nisdn/CVE-2021-40978[WEB]
https://github.com/mkdocs/mkdocs[WEB]
https://github.com/nisdn/CVE-2021-40978/issues/1[REPORT]
https://github.com/mkdocs/mkdocs/issues/2601[REPORT]
https://github.com/advisories/GHSA-qh9q-34h6-hcv9[ADVISORY]