CVE-2020-4059
Command injection in mversion
Résumé
Command injection in mversion
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Impact
This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.
Patches
Patched by version 2.0.0. Previous releases are deprecated in npm.
Workarounds
Make sure to escape git commit messages when using the commitMessage option for the update function.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
npm
mversion
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}]
Références
- advisory nvd.nist.gov
- web github.com
- web github.com