GHSA-g8vp-6hv4-m67c

Source

https://github.com/advisories/GHSA-g8vp-6hv4-m67c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-g8vp-6hv4-m67c/GHSA-g8vp-6hv4-m67c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g8vp-6hv4-m67c

Published

2020-09-11T21:23:29Z

Modified

2020-08-31T18:43:32Z

Summary

Command Injection in entitlements

Details

Versions of entitlements prior to 1.3.0 are vulnerable to Command Injection. The package does not validate input on the entitlements function and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.

Recommendation

Upgrade to version 1.3.0 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-77"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:43:32Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / entitlements

Package

Name: entitlements; View open source insights on deps.dev
Purl: pkg:npm/entitlements

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-g8vp-6hv4-m67c/GHSA-g8vp-6hv4-m67c.json"