GHSA-v8v8-6859-qxm4

Source

https://github.com/advisories/GHSA-v8v8-6859-qxm4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-v8v8-6859-qxm4/GHSA-v8v8-6859-qxm4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-v8v8-6859-qxm4

Aliases

CVE-2020-8149

Published

2020-06-05T14:47:02Z

Modified

2023-11-08T04:04:14Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Arbitrary shell command execution in logkitty

Details

Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1.

Database specific

{
    "cwe_ids":  [
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-04T19:33:24Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

Affected packages

npm / logkitty

Package

Name: logkitty; View open source insights on deps.dev
Purl: pkg:npm/logkitty

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.7.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-v8v8-6859-qxm4/GHSA-v8v8-6859-qxm4.json"