GHSA-f2jw-pr2c-9x96

Source

https://github.com/advisories/GHSA-f2jw-pr2c-9x96

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-f2jw-pr2c-9x96/GHSA-f2jw-pr2c-9x96.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f2jw-pr2c-9x96

Aliases

CVE-2021-29369

Published

2022-02-10T23:41:49Z

Modified

2023-11-08T04:05:33Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Code injection in @rkesters/gnuplot

Details

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.

Database specific

{
    "cwe_ids":  [
        "CWE-77",
        "CWE-78"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-05-19T21:39:05Z",
    "nvd_published_at":  "2021-05-03T12:15:00Z",
    "severity":  "CRITICAL"
}

References

Affected packages

npm / @rkesters/gnuplot

Package

Name: @rkesters/gnuplot; View open source insights on deps.dev
Purl: pkg:npm/%40rkesters/gnuplot

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.1.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-f2jw-pr2c-9x96/GHSA-f2jw-pr2c-9x96.json"