GitHub Advisoryadvisory · crates.io
GHSA-p24j-h477-76q3 Uncontrolled Search Path Element in sharkdp/bat
HIGH
Official page ↗
- Aliases
- CVE-2021-36753
- Ecosystem
- crates.io
- Packages
- bat
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-427
- Reviewed
- 2021-07-19
Affected packages
• crates.io bat: < 0.18.2 → fixed in 0.18.2
Description
bat on windows before 0.18.2 executes programs named less.exe from the current working directory. This can lead to unintended code execution.
Related
Alias · CVE (1)
- CVE-2021-36753 sharkdp BAT before 0.18.2 executes less.exe from the current working directory. vulnerability
Weakness · CWE (1)
- CWE-427 Uncontrolled Search Path Element weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-36753 advisory
- https://github.com/sharkdp/bat/pull/1724 web
- https://github.com/sharkdp/bat/commit/bf2b2df9c9e218e35e5a38ce3d03cffb7c363956 web
- https://github.com/sharkdp/bat package
- https://github.com/sharkdp/bat/releases/tag/v0.18.2 web
- https://rustsec.org/advisories/RUSTSEC-2021-0106.html web
- https://vuln.ryotak.me/advisories/53 web