Description

naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is directly used by the exec function.

Remediation

References

https://github.com/naholyr/github-todos/issues/34

https://github.com/dwisiswant0/advisory/issues/5

Related Vulnerabilities

CVE-2020-7602 Vulnerability in npm package node-prompt-here

CVE-2021-23432 Vulnerability in npm package mootools

CVE-2018-16487 Vulnerability in npm package lodash.mergewith

CVE-2020-13697 Vulnerability in maven package org.nanohttpd:nanohttpd-nanolets

CVE-2021-32803 Vulnerability in npm package tar

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Issue Tracking Third Party Advisory Exploit