GHSA-3mpg-q26j-83j5

Command injection in yiisoft/yii2-gii

Source: GitHub Advisory Database (reviewed) High CVE-2020-36655

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	yiisoft/yii2-gii	< 2.2.2	2.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-36655 advisory
https://github.com/yiisoft/yii2-gii/issues/433 web
https://github.com/yiisoft/yii2-gii/commit/ed61e0d85f43e23f79d7c9d1b4e5e5c09a32ce4b web
https://github.com/yiisoft/yii2-gii package
https://lab.wallarm.com/yii2-gii-remote-code-execution web