~ / search / GHSA-pf8j-vhg8-xmc3

GHSA-pf8j-vhg8-xmc3

karma-mojo enables OS Command Injection

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-7626

Packages

EcosystemPackageAffectedFixed in
npm karma-mojo <= 1.0.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument.

References

External links from the advisory. They lead to third-party sites.