GHSA-6q8m-42qq-64r7
Imperative CLI vulnerable to Command Injection
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @zowe/imperative | >= 5.0.0, < 5.7.1 | 5.7.1 |
| npm | @zowe/imperative | < 4.18.10 | 4.18.10 |
Details
As written in the advisory (Markdown source, shown as plain text).
A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI.
References
External links from the advisory. They lead to third-party sites.