GHSA-87cj-px37-rc3x

Source

https://github.com/advisories/GHSA-87cj-px37-rc3x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-87cj-px37-rc3x/GHSA-87cj-px37-rc3x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-87cj-px37-rc3x

Aliases

CVE-2021-23422
PYSEC-2021-116
SNYK-PYTHON-BIKESHED-1537646

Published

2021-08-30T16:25:35Z

Modified

2024-09-04T21:24:00.598721Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

OS Command Injection in bikeshed

Details

This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output.

Database specific

{
    "github_reviewed_at": "2021-08-26T15:58:50Z",
    "cwe_ids": [
        "CWE-78"
    ],
    "nvd_published_at": "2021-08-16T08:15:00Z",
    "severity": "HIGH",
    "github_reviewed": true
}

References

Affected packages

PyPI / bikeshed

Package

Name: bikeshed; View open source insights on deps.dev
Purl: pkg:pypi/bikeshed

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.0

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.1.0

1.2.0

1.2.1

1.2.2

1.3.0

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.5.0

1.5.1

1.5.2

1.5.3

1.6.0

1.6.1

1.6.2

1.6.3

1.7.0

2.*

2.0.0

2.1.0

2.2.0

2.2.1

2.2.2

2.2.3

2.3.0

2.3.1

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

2.4.6

2.4.7