CRITICAL9.8

GHSA-4228-7qvx-f4rq

Injection and Command Injection in devcert

Quick fix

GHSA-4228-7qvx-f4rq — devcert: upgrade to the fixed version with the command below.

npm install devcert@1.1.2

Details

A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFor` function.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/devcert

Introduced in: 0Fixed in: 1.1.2

Fixnpm install devcert@1.1.2

References

https://nvd.nist.gov/vuln/detail/CVE-2020-8186[ADVISORY]
https://hackerone.com/reports/863544[WEB]