~ / search / GHSA-3p94-vj97-fm4q

GHSA-3p94-vj97-fm4q

OS Command Injection in fsa

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-7615

Packages

EcosystemPackageAffectedFixed in
npm fsa <= 0.5.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand()', located within 'lib/rep.js#63' can be controlled by users without any sanitization to inject arbitrary commands.

References

External links from the advisory. They lead to third-party sites.