GHSA-4859-gpc7-4j66

Source

https://github.com/advisories/GHSA-4859-gpc7-4j66

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-4859-gpc7-4j66/GHSA-4859-gpc7-4j66.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4859-gpc7-4j66

Published

2019-06-05T21:24:29Z

Modified

2021-08-04T20:55:57Z

Summary

Command Injection in dot

Details

All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype.

Database specific

{
    "cwe_ids": [
        "CWE-77"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-06-05T21:24:18Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

npm / dot

Package

Name: dot; View open source insights on deps.dev
Purl: pkg:npm/dot

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.1.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-4859-gpc7-4j66/GHSA-4859-gpc7-4j66.json"