CRITICAL9.8

GHSA-vm5j-vqr6-v7v8

OS Command Injection in pixl-class

Quick fix

GHSA-vm5j-vqr6-v7v8 — pixl-class: upgrade to the fixed version with the command below.

npm install pixl-class@1.0.3

Details

pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/pixl-class

Introduced in: 0Fixed in: 1.0.3

Fixnpm install pixl-class@1.0.3

References

https://nvd.nist.gov/vuln/detail/CVE-2020-7640[ADVISORY]
https://github.com/jhuckaby/pixl-class/commit/47677a3638e3583e42f3a05cc7f0b30293d2acc8[WEB]
https://github.com/jhuckaby/pixl-class/commit/47677a3638e3583e42f3a05cc7f0b30293d2acc8,[WEB]
https://snyk.io/vuln/SNYK-JS-PIXLCLASS-564968[WEB]