GitHub Advisoryadvisory · npm

GHSA-qjg4-w4c6-f6c6 Command injection in mversion

HIGH Published 2020-06-18 Modified 2021-01-08 Official page ↗
Aliases
CVE-2020-4059
Ecosystem
npm
Packages
mversion
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-77
Reviewed
2020-06-17

Affected packages

• npm mversion: < 2.0.0 → fixed in 2.0.0

Description

Impact This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. Patches Patched by version 2.0.0. Previous releases are deprecated in npm. Workarounds Make sure to escape git commit messages when using the commitMessage option for the update function.

Related

Alias · CVE (1)

  • CVE-2020-4059 In mversion before 2.0.0, there is a command injection vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References