GitHub Advisoryadvisory · PyPI

GHSA-f4q6-9qm4-h8j4 OS Command Injection in cookiecutter

CRITICAL Published 2022-06-09 Modified 2024-11-18 Official page ↗
Aliases
CVE-2022-24065
Ecosystem
PyPI
Packages
cookiecutter
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2022-06-09

Affected packages

• PyPI cookiecutter: < 2.1.1 → fixed in 2.1.1

Description

The package cookiecutter before 2.1.1 is vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Related

Alias · CVE (1)

  • CVE-2022-24065 The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References