Description

All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization.

Remediation

References

https://snyk.io/vuln/SNYK-JS-GITLOGPLUS-1315832

https://hackerone.com/reports/808942

https://www.npmjs.com/package/gitlogplus

Related Vulnerabilities

CVE-2022-41376 Vulnerability in npm package metro4

CVE-2018-16487 Vulnerability in npm package @sailshq/lodash

CVE-2022-31180 Vulnerability in npm package shescape

CVE-2022-31167 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security

CVE-2020-36048 Vulnerability in npm package engine.io

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Product