GHSA-gc94-6w89-hpqr

Source

https://github.com/advisories/GHSA-gc94-6w89-hpqr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-gc94-6w89-hpqr/GHSA-gc94-6w89-hpqr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gc94-6w89-hpqr

Published

2019-06-12T16:37:07Z

Modified

2021-09-16T20:59:56Z

Summary

Command Injection in fs-path

Details

All versions of fs-path are vulnerable to command injection is unsanitized user input is passed in.

Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.

Database specific

{
    "cwe_ids":  [
        "CWE-77"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2019-06-12T16:34:26Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / fs-path

Package

Name: fs-path; View open source insights on deps.dev
Purl: pkg:npm/fs-path

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.0.25

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-gc94-6w89-hpqr/GHSA-gc94-6w89-hpqr.json"