GitHub Advisoryadvisory · npm

GHSA-3fxp-vwxm-2r5p Command injection in gitlogplus

CRITICAL Published 2021-07-26 Modified 2021-08-03 Official page ↗
Aliases
CVE-2021-23412
Ecosystem
npm
Packages
gitlogplus
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2021-07-26

Affected packages

• npm gitlogplus: <= 3.1.7 (no fix yet)

Description

All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization.

Related

Alias · CVE (1)

  • CVE-2021-23412 All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References