Description

fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand()', located within 'lib/rep.js#63' can be controlled by users without any sanitization to inject arbitrary commands.

Remediation

References

https://snyk.io/vuln/SNYK-JS-FSA-564118

https://github.com/gregof/fsa/blob/master/lib/rep.js#L12

Related Vulnerabilities

CVE-2020-28469 Vulnerability in maven package org.webjars.npm:glob-parent

CVE-2010-0684 Vulnerability in maven package org.apache.activemq:activemq-web

CVE-2020-28472 Vulnerability in maven package org.webjars.npm:aws-sdk

CVE-2020-13957 Vulnerability in maven package org.apache.solr:solr-solrj

CVE-2019-10798 Vulnerability in npm package rdf-graph-array

Severity

High

Classification

CWE-78 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Patch