GitHub Advisoryadvisory · npm

GHSA-487w-pqcm-63hq Command injection in buns

CRITICAL Published 2021-01-13 Modified 2023-09-08 Official page ↗
Aliases
CVE-2020-7794
Ecosystem
npm
Packages
buns
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77, CWE-78
Reviewed
2021-01-12

Affected packages

• npm buns: <= 1.1.6 (no fix yet)

Description

There is a command injection vulnerability in all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModule).

Related

Alias · CVE (1)

  • CVE-2020-7794 This affects all versions of package buns. vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References