GHSA-6f9p-g466-f8v8

blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-26143

Packages

Ecosystem	Package	Affected	Fixed in
npm	blamer	< 1.0.4	1.0.4

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the blamer package before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-26143 advisory
https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3 web
https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9 web
https://github.com/kucherenko/blamer package
https://security.snyk.io/vuln/SNYK-JS-BLAMER-5731318 web