~ / search / GHSA-487w-pqcm-63hq

GHSA-487w-pqcm-63hq

Command injection in buns

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-7794

Packages

EcosystemPackageAffectedFixed in
npm buns <= 1.1.6 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

There is a command injection vulnerability in all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModule).

References

External links from the advisory. They lead to third-party sites.