GHSA-87cj-px37-rc3x

Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-87cj-px37-rc3x/GHSA-87cj-px37-rc3x.json
Aliases
Published
2021-08-30T16:25:35Z
Modified
2022-09-19T02:16:12.793398Z
Details

This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output.

References

Affected packages

PyPI / bikeshed

bikeshed

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0
Fixed
3.0.0

Affected versions

1.*

1.0.0
1.0.1
1.0.10
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.2.0
1.2.1
1.2.2
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.6.0
1.6.1
1.6.2
1.6.3
1.7.0

2.*

2.0.0
2.1.0
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7