GHSA-xm99-6pv5-q363
Disputed: OS Command injection in github.com/kardianos/service
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/kardianos/service | <= 1.2.1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intended directory.
The validity of this vulnerability has been [questioned](https://github.com/kardianos/service/pull/290#issuecomment-1109831505) and the reporter has requested that the CVE be [disputed](https://github.com/kardianos/service/issues/289#issuecomment-1110546798).
References
External links from the advisory. They lead to third-party sites.