GHSA-qjg4-w4c6-f6c6

Command injection in mversion

Source: GitHub Advisory Database (reviewed) High CVE-2020-4059

Packages

Ecosystem	Package	Affected	Fixed in
npm	mversion	< 2.0.0	2.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. ### Patches Patched by version 2.0.0. Previous releases are deprecated in npm. ### Workarounds Make sure to escape git commit messages when using the commitMessage option for the update function.

References

External links from the advisory. They lead to third-party sites.

https://github.com/mikaelbr/mversion/security/advisories/GHSA-qjg4-w4c6-f6c6 web
https://nvd.nist.gov/vuln/detail/CVE-2020-4059 advisory
https://github.com/mikaelbr/mversion/commit/6c76c9efd27c7ff5a5c6f187e8b7a435c4722338 web