GitHub Advisoryadvisory · npm, Maven

GHSA-3c6g-pvg8-gqw2 trentm/json vulnerable to command injection

HIGH Published 2021-05-06 Modified 2023-09-11 Official page ↗
Aliases
CVE-2020-7712
Ecosystem
npm, Maven
Packages
json, org.webjars.npm:json
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2021-05-05

Affected packages

• npm json: < 10.0.0 → fixed in 10.0.0 • Maven org.webjars.npm:json: <= 9.0.6 (no fix yet)

Description

This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.

Related

Alias · CVE (1)

  • CVE-2020-7712 This affects the package json before 10.0.0. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References