~ / search / GHSA-xmxh-g7wj-8m4m

GHSA-xmxh-g7wj-8m4m

OS Command Injection in curling

Source: GitHub Advisory Database (reviewed) High CVE-2019-10789

Packages

EcosystemPackageAffectedFixed in
npm curling < 1.1.0 1.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

npm package `curling` before version 1.1.0 is vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization.

References

External links from the advisory. They lead to third-party sites.