GitHub Advisoryadvisory · npm

GHSA-549f-73hh-mj38 Command Injection in gitlabhook

CRITICAL Published 2019-09-16 Modified 2023-06-01 Official page ↗
Aliases
CVE-2019-5485
Ecosystem
npm
Packages
gitlabhook
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2019-09-16

Affected packages

• npm gitlabhook: <= 0.0.17 (no fix yet)

Description

All versions of `gitlabhook` are vulnerable to Command Injection. The package does not validate input the body of POST request and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Alias · CVE (1)

  • CVE-2019-5485 NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References