GitHub Advisoryadvisory · npm

GHSA-qm28-7hqv-wg5j OS Command Injection in ng-packagr

MEDIUM Published 2021-05-07 Modified 2021-10-05 Official page ↗

Aliases: CVE-2020-7735
Ecosystem: npm
Packages: ng-packagr
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-78
Reviewed: 2021-04-27

Affected packages

• npm ng-packagr: < 10.1.1 → fixed in 10.1.1

Description

The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.

Related

Alias · CVE (1)

CVE-2020-7735 The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option. vulnerability

Weakness · CWE (1)

CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References