@blinkbooks/types (>=1.0.5, <=1.4.0), @favware/cliff-jumper (>=4.0.0-next.007cda3, <=6.0.1-next.fbc3065) +36 more potentially affected by CVE-2025-59433 via @conventional-changelog/git-client (1.0.1)

@conventional-changelog/git-client NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @conventional-changelog/git-client and may be impacted: - @blinkbooks/types =1.0.5, =4.0.0-next.007cda3, =1.19.0, =3.0.0-beta.13, =2.10.0, =3.0.0-beta....

CVE-2025-59433: Improper Neutralization of Argument Delimiters in a Command

Conventional Changelog generates changelogs and release notes from a project's commit messages and metadata. Prior to version 2.0.0, @conventional-changelog/git-client has an argument injection vulnerability. This vulnerability manifests with the library's getTags API, which allows extra paramete...