CVE-2020-4059
Command injection in mversion
Summary
Command injection in mversion
Original description
The description as published by the source.
Impact
This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.
Patches
Patched by version 2.0.0. Previous releases are deprecated in npm.
Workarounds
Make sure to escape git commit messages when using the commitMessage option for the update function.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
npm
mversion
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}]
References
- advisory nvd.nist.gov
- web github.com
- web github.com