~ / search / GHSA-6m8p-4fxj-pgc2

GHSA-6m8p-4fxj-pgc2

OS Command Injection in mversion

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-7688

Packages

EcosystemPackageAffectedFixed in
npm mversion < 2.0.1 2.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.

References

External links from the advisory. They lead to third-party sites.