GitHub Advisoryadvisory · npm

GHSA-77qv-gh6f-pgh4 Command Injection in Limdu

LOW Published 2020-06-22 Modified 2023-03-31 Official page ↗
Aliases
CVE-2020-4066
Ecosystem
npm
Packages
limdu
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-78
Reviewed
2020-06-17

Affected packages

• npm limdu: < 0.9.5 → fixed in 0.9.5

Description

Impact The `trainBatch` function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. Patches Patched in version 0.9.5. Workarounds Do not use trainBatch with classifiers that rely on shell execution, such as SVM Perf, SVM Linear or Adaboost References No

Related

Alias · CVE (1)

  • CVE-2020-4066 In Limdu before 0.95, the trainBatch function has a command injection vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References