GitHub Advisoryadvisory · npm
GHSA-pjh3-jv7w-9jpr Command Injection in gm
CRITICAL
Official page ↗
- Aliases
- CVE-2015-7982
- Ecosystem
- npm
- Packages
- gm
- Severity
- Critical
- Weaknesses
- CWE-77
- Reviewed
- 2020-08-31
Affected packages
• npm gm: < 1.21.1 → fixed in 1.21.1
Description
Versions of `gm` prior to 1.21.1 are affected by a command injection vulnerability. The vulnerability is triggered when user input is passed into `gm.compare()`, which fails to sanitize input correctly before calling the graphics magic binary.
Recommendation
Update to version 1.21.1 or later.
Related
Alias · not in database (1)
Weakness · CWE (1)
- CWE-77 Improper Neutralization of Special Elements used in a Command weakness