Impact

Arbitrary command execution could occur in some circumstances due to a vulnerability in requests-cache. We do not believe there is a high risk from use of our services but strongly advise you upgrade and conduct your own review.

Please see https://phab.mirahezebots.org/T228 for work to harden this function.

Patches

Pull cefb261 or after. Upgrade requirements. (https://github.com/MirahezeBots/MirahezeBots/commit/cefb261ff392a3de39a467449aa9033b5d8aa803.patch)

Workarounds

Upgrade requests-cache

References

https://snyk.io/vuln/SNYK-PYTHON-REQUESTSCACHE-1089050
https://phab.mirahezebots.org/phame/post/view/6/requests-cache_security_incident/

For more information

If you have any questions or comments about this advisory:

• Open an issue on Phabricator
• Email us at staff{at}mirahezebots{dot}org