GitHub Advisoryadvisory · npm

GHSA-8cxp-cjm8-fj36 Improper Neutralization of Special Elements used in an OS Command in Blamer

CRITICAL Published 2022-05-24 Modified 2022-06-28 Official page ↗
Aliases
CVE-2019-10807
Ecosystem
npm
Packages
blamer
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2022-06-28

Affected packages

• npm blamer: < 1.0.1 → fixed in 1.0.1

Description

Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer.

Related

Alias · CVE (1)

  • CVE-2019-10807 Blamer versions prior to 1.0.1 allows execution of arbitrary commands. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References