GHSA-hwch-749c-rv63
Potential Command Injection in hubot-scripts
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | hubot-scripts | < 2.4.5 | 2.4.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
Versions 2.4.3 and earlier of hubot-scripts are vulnerable to a command injection vulnerablity in the `hubot-scripts/package/src/scripts/email.coffee` module.
### Mitigating Factors
The email script is not enabled by default, it has to be manually added to hubot's list of loaded scripts.
## Recommendation
Update hubot-scripts to version 2.4.4 or later.
References
External links from the advisory. They lead to third-party sites.