JVN#80506242: awkblog vulnerable to OS command injection

awkblog provided by Keisuke Nakayama contains an OS command injection vulnerability (CWE-78).

Impact

If a remote unauthenticated attacker sends a specially crafted HTTP request, an arbitrary OS command may be executed with the privileges of the affected product on the machine running the product.

Solution

Apply the Patch
Apply the patch according to the information provided by the developer.
The developer has released the following patch to address this vulnerability.

• awkblog v0.0.2 (commit hash:13f62021258f7256f1567c4bb5fa6bddcfccde72)

Products Affected

• awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier