GHSA-8cxp-cjm8-fj36

Improper Neutralization of Special Elements used in an OS Command in Blamer

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-10807

Packages

Ecosystem	Package	Affected	Fixed in
npm	blamer	< 1.0.1	1.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10807 advisory
https://github.com/kucherenko/blamer/commit/5fada8c9b6986ecd28942b724fa682e77ce1e11c web
https://github.com/kucherenko/blamer package
https://snyk.io/vuln/SNYK-JS-BLAMER-559541 web