GitHub Advisoryadvisory · npm

GHSA-6f9p-g466-f8v8 blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API

MEDIUM Published 2023-09-19 Modified 2025-09-26 Official page ↗
Aliases
CVE-2023-26143
Ecosystem
npm
Packages
blamer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-88
Reviewed
2023-09-21

Affected packages

• npm blamer: < 1.0.4 → fixed in 1.0.4

Description

Versions of the blamer package before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.

Related

Alias · CVE (1)

  • CVE-2023-26143 Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. vulnerability

Weakness · CWE (1)

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References