HIGH7.8
GHSA-p24j-h477-76q3
Uncontrolled Search Path Element in sharkdp/bat
Details
bat on windows before 0.18.2 executes programs named less.exe from the current working directory. This can lead to unintended code execution.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-36753[ADVISORY]
- https://github.com/sharkdp/bat/pull/1724[WEB]
- https://github.com/sharkdp/bat/commit/bf2b2df9c9e218e35e5a38ce3d03cffb7c363956[WEB]
- https://github.com/sharkdp/bat[PACKAGE]
- https://github.com/sharkdp/bat/releases/tag/v0.18.2[WEB]
- https://rustsec.org/advisories/RUSTSEC-2021-0106.html[WEB]
- https://vuln.ryotak.me/advisories/53[WEB]