~ / search / GHSA-vr9x-mm65-2438

GHSA-vr9x-mm65-2438

Withdrawn on 2020-10-19. GitHub withdrew this advisory; it no longer applies.

Command Injection in jison

Source: GitHub Advisory Database (reviewed) High CVE-2020-8178

Packages

EcosystemPackageAffectedFixed in
npm jison <= 0.4.18 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

**Withdrawn:** This vulnerability is not present in the released npm package. Rather the vulnerable code is part of the repo, but not part of the package. See linked hackerone report for more details. Insufficient input validation in npm package `jison` <= 0.4.18 may lead to OS command injection attacks.

References

External links from the advisory. They lead to third-party sites.