You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Vulnerable Package issue exists @ Npm-commander-2.17.1 in branch main
A local code/OS command execution vulnerability was discovered in Commander.js, in the “parse()” method. Given a permission to write and set permissions on a file in the same working directory as the application, and given the ability to pass the value “proto” to the “parse()” method, an attacker can bypass checks against values set in _execs[] to execute an external file which was not intended.
Vulnerable Package issue exists @ Npm-commander-2.17.1 in branch main
A local code/OS command execution vulnerability was discovered in Commander.js, in the “parse()” method. Given a permission to write and set permissions on a file in the same working directory as the application, and given the ability to pass the value “proto” to the “parse()” method, an attacker can bypass checks against values set in _execs[] to execute an external file which was not intended.
Namespace: Svetlana-github
Repository: test
Repository Url: https://github.com/Svetlana-github/test
CxAST-Project: Svetlana-github/test
CxAST platform scan: 8821ba41-d324-41fa-8053-d13dfc156a43
Branch: main
Application: test
Severity: MEDIUM
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-1321
Addition Info
Attack vector: LOCAL
Attack complexity: HIGH
Confidentiality impact: LOW
Availability impact: LOW
Remediation Upgrade Recommendation: 2.20.1
References
Release Note
Pull request
Commit
Advisory
The text was updated successfully, but these errors were encountered: