Description

versionn, software for changing version information across multiple files, has a command injection vulnerability in all versions prior to version 1.1.0. This issue is patched in version 1.1.0.

Remediation

References

https://github.com/commenthol/versionn/commit/2ca128823efe962b37f2698f0eb530c2b124842d

https://github.com/commenthol/versionn/security/advisories/GHSA-fj78-2vc5-f6cm

Related Vulnerabilities

CVE-2022-25916 Vulnerability in npm package mt7688-wiscan

CVE-2022-29546 Vulnerability in maven package org.codelibs:nekohtml

CVE-2022-24431 Vulnerability in npm package abacus-ext-cmdline

CVE-2022-25210 Vulnerability in maven package com.convertigo.jenkins.plugins:convertigo-mobile-platform

CVE-2020-11072 Vulnerability in npm package slpjs

Severity

Critical

Classification

CWE-77 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory