GHSA-m2fc-9h5m-29cm

@acrontum/filesystem-template vulnerable to Command Injection due to fetchRepo API missing sanitization

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-21186

Packages

Ecosystem	Package	Affected	Fixed in
npm	@acrontum/filesystem-template	< 0.0.2	0.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

The package @acrontum/filesystem-template before 0.0.2 is vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-21186 advisory
https://github.com/acrontum/filesystem-template/issues/13 web
https://github.com/acrontum/filesystem-template/pull/14/commits/baeb727b60991ad82d9e63ac660883793abc0acc web
https://github.com/acrontum/filesystem-template/commit/baeb727b60991ad82d9e63ac660883793abc0acc web
https://github.com/acrontum/filesystem-template package
https://security.snyk.io/vuln/SNYK-JS-ACRONTUMFILESYSTEMTEMPLATE-2419071 web