~ / search / GHSA-4228-7qvx-f4rq

GHSA-4228-7qvx-f4rq

Injection and Command Injection in devcert

Source: GitHub Advisory Database (reviewed) High CVE-2020-8186

Packages

EcosystemPackageAffectedFixed in
npm devcert < 1.1.2 1.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFor` function.

References

External links from the advisory. They lead to third-party sites.