GHSA-jfm8-hwhg-r6gg

Source

https://github.com/advisories/GHSA-jfm8-hwhg-r6gg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-jfm8-hwhg-r6gg/GHSA-jfm8-hwhg-r6gg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jfm8-hwhg-r6gg

Aliases

CVE-2022-25171

Published

2022-12-20T06:30:36Z

Modified

2025-04-16T16:08:22Z

Severity

7.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

p4 vulnerable to Command Injection due to improper input sanitization

Details

The package p4 before 0.0.7 is vulnerable to Command Injection via the run() function due to improper input sanitization

Database specific

{
    "cwe_ids":  [
        "CWE-78"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-12-20T17:38:21Z",
    "nvd_published_at":  "2022-12-20T05:15:00Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / p4

Package

Name: p4; View open source insights on deps.dev
Purl: pkg:npm/p4

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.0.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-jfm8-hwhg-r6gg/GHSA-jfm8-hwhg-r6gg.json"