GHSA-4gjv-5jjp-rcgh
HashBrown CMS RCE
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | hashbrown-cms | < 1.3.4 | 1.3.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
A remote code execution issue was discovered in HashBrown CMS through 1.3.3. `Server/Entity/Deployer/GitDeployer.js` has a `Service.AppService.exec call` that mishandles the URL, repository, username, and password.
References
External links from the advisory. They lead to third-party sites.