~ / search / GHSA-77qv-gh6f-pgh4

GHSA-77qv-gh6f-pgh4

Command Injection in Limdu

Source: GitHub Advisory Database (reviewed) Low CVE-2020-4066

Packages

EcosystemPackageAffectedFixed in
npm limdu < 0.9.5 0.9.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The `trainBatch` function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. ### Patches Patched in version 0.9.5. ### Workarounds Do not use trainBatch with classifiers that rely on shell execution, such as SVM Perf, SVM Linear or Adaboost ### References No

References

External links from the advisory. They lead to third-party sites.