MEDIUM6.5
GHSA-6f9p-g466-f8v8
blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API
Quick fix
GHSA-6f9p-g466-f8v8 — blamer: upgrade to the fixed version with the command below.
npm install blamer@1.0.4Details
Versions of the blamer package before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-26143[ADVISORY]
- https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3[WEB]
- https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9[WEB]
- https://github.com/kucherenko/blamer[PACKAGE]
- https://security.snyk.io/vuln/SNYK-JS-BLAMER-5731318[WEB]