GitHub Advisoryadvisory · npm

GHSA-3p94-vj97-fm4q OS Command Injection in fsa

MEDIUM Published 2021-12-09 Modified 2021-05-25 Official page ↗
Aliases
CVE-2020-7615
Ecosystem
npm
Packages
fsa
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2021-05-25

Affected packages

• npm fsa: <= 0.5.1 (no fix yet)

Description

fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand()', located within 'lib/rep.js#63' can be controlled by users without any sanitization to inject arbitrary commands.

Related

Alias · CVE (1)

  • CVE-2020-7615 fsa through 0.5.1 is vulnerable to Command Injection. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References