Description

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options.

Remediation

References

https://snyk.io/vuln/SNYK-JS-GULPTAPE-560124

Related Vulnerabilities

CVE-2023-45884 Vulnerability in npm package openmct

CVE-2016-4055 Vulnerability in npm package moment

CVE-2021-29300 Vulnerability in npm package opened

CVE-2020-28478 Vulnerability in npm package gsap

CVE-2020-7687 Vulnerability in npm package fast-http

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory