CVE-2024-21624: Nonebot

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.

Affected products

• Nonebot Nonebot: from 2.0.1, before 2.2.0 (fixed in 2.2.0); version 2.0.0 only

Published 2024-02-09. Last modified 2026-06-17.