GitHub Advisoryadvisory · npm

GHSA-6xv6-jpvw-cx6q Command injection in bestzip

CRITICAL Published 2021-05-06 Modified 2021-05-04 Official page ↗

Aliases: CVE-2020-7730
Ecosystem: npm
Packages: bestzip
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-78
Reviewed: 2021-05-04

Affected packages

• npm bestzip: < 2.1.7 → fixed in 2.1.7

Description

The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.

Related

Alias · CVE (1)

CVE-2020-7730 The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param. vulnerability

Weakness · CWE (1)

CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References