Description

Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer.

Remediation

References

https://snyk.io/vuln/SNYK-JS-BLAMER-559541

https://github.com/kucherenko/blamer/commit/5fada8c9b6986ecd28942b724fa682e77ce1e11c%2C

Related Vulnerabilities

CVE-2022-47042 Vulnerability in maven package net.mingsoft:ms-mcms

CVE-2021-41249 Vulnerability in npm package graphql-playground-react

CVE-2022-45394 Vulnerability in maven package org.jenkins-ci.plugins:delete-log-plugin

CVE-2022-25296 Vulnerability in npm package bodymen

CVE-2018-3757 Vulnerability in npm package pdf-image

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Patch Third Party Advisory