GitHub Advisoryadvisory · PyPI

GHSA-87cj-px37-rc3x OS Command Injection in bikeshed

HIGH Published 2021-08-30 Modified 2024-09-04 Official page ↗
Aliases
CVE-2021-23422
Ecosystem
PyPI
Packages
bikeshed
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2021-08-26

Affected packages

• PyPI bikeshed: < 3.0.0 → fixed in 3.0.0

Description

This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output.

Related

Alias · CVE (1)

  • CVE-2021-23422 This affects the package bikeshed before 3.0.0. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References