Description

The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.

Remediation

References

https://security.snyk.io/vuln/npm:pullit:20180214

https://github.com/jkup/pullit/commit/4fec455774ee08f4dce0ef2ef934ffcc37219bfb

Related Vulnerabilities

CVE-2023-3414 Vulnerability in maven package io.jenkins.plugins:servicenow-devops

CVE-2022-0144 Vulnerability in npm package shelljs

CVE-2021-25931 Vulnerability in maven package org.opennms:opennms-webapp

CVE-2022-0350 Vulnerability in npm package vditor

CVE-2021-26540 Vulnerability in npm package sanitize-html

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Patch