CRITICAL9.8

GHSA-8cxp-cjm8-fj36

Improper Neutralization of Special Elements used in an OS Command in Blamer

Quick fix

GHSA-8cxp-cjm8-fj36 — blamer: upgrade to the fixed version with the command below.

npm install blamer@1.0.1

Details

Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/blamer

Introduced in: 0Fixed in: 1.0.1

Fixnpm install blamer@1.0.1

References

https://nvd.nist.gov/vuln/detail/CVE-2019-10807[ADVISORY]
https://github.com/kucherenko/blamer/commit/5fada8c9b6986ecd28942b724fa682e77ce1e11c[WEB]
https://github.com/kucherenko/blamer[PACKAGE]
https://snyk.io/vuln/SNYK-JS-BLAMER-559541[WEB]