GHSA-f4q6-9qm4-h8j4

Source

https://github.com/advisories/GHSA-f4q6-9qm4-h8j4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-f4q6-9qm4-h8j4/GHSA-f4q6-9qm4-h8j4.json

Aliases

• CVE-2022-24065
• PYSEC-2022-204
• SNYK-PYTHON-COOKIECUTTER-2414281

Published

2022-06-09T23:48:49Z

Modified

2024-02-16T07:59:19.372635Z

Details

The package cookiecutter before 2.1.1 is vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-24065
• https://github.com/cookiecutter/cookiecutter/commit/fdffddb31fd2b46344dfa317531ff155e7999f77
• https://github.com/advisories/GHSA-f4q6-9qm4-h8j4
• https://github.com/cookiecutter/cookiecutter
• https://github.com/cookiecutter/cookiecutter/releases/tag/2.1.1
• https://github.com/pypa/advisory-database/tree/main/vulns/cookiecutter/PYSEC-2022-204.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G5TXC4JYTNGOUFMCXPZ6QKWEZN3URTAK
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQKWT7SGFDCUPPLDIELTN7FVTHWDL5YK
• https://snyk.io/vuln/SNYK-PYTHON-COOKIECUTTER-2414281