Description

The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.

Remediation

References

https://security.snyk.io/vuln/npm:pullit:20180214

https://github.com/jkup/pullit/commit/4fec455774ee08f4dce0ef2ef934ffcc37219bfb

Related Vulnerabilities

CVE-2018-3784 Vulnerability in npm package cryo

CVE-2020-11020 Vulnerability in npm package faye

CVE-2023-22894 Vulnerability in npm package @strapi/strapi

CVE-2016-10540 Vulnerability in maven package org.webjars.npm:minimatch

CVE-2010-2275 Vulnerability in npm package dojo

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Patch