442 matches found
gulp-teddy (>=0.0.1, <=1.6.1), roosevelt (>=0.4.9, <=0.4.33) potentially affected by CVE-2021-23447 via teddy (>=0.2.52, <=0.4.28)
teddy NPM version =0.2.52, =0.0.1, =0.4.9, =0.4.33 Source cves: CVE-2021-23447 Source advisory: SNYK:JS-TEDDY-1579557...
gulp-controlled-merge-json (0.2.1) potentially affected by CVE-2020-28268 via controlled-merge (1.1.0)
controlled-merge NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on controlled-merge and may be impacted: - gulp-controlled-merge-json 0.2.1 Source cves: CVE-2020-28268 Source advisory: OSV:GHSA-5PG7-V24C-9RP9...
Injection in gulp-scss-lint
Overview gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options. Recommendation Avoid using gulp-scss-lint as there is no current safe version of this module...
GHSA-G4HJ-R7R3-9RWV OS Command Injection in gulp-scss-lint
gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...
OS Command Injection in gulp-scss-lint
gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...
OS Command Injection in gulp-tape
gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of gulp-tape options...
GHSA-X67X-98X7-WV26 OS Command Injection in gulp-tape
gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of gulp-tape options...
OS Command Injection in gulkp-styledocco
gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument options of the exports function in index.js can be controlled by users without any sanitization...
GHSA-H33P-5J96-W8QH OS Command Injection in gulkp-styledocco
gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument options of the exports function in index.js can be controlled by users without any sanitization...
Command Injection in nuance-gulp-build-common
All versions of package nuance-gulp-build-common are vulnerable to Command Injection via the index.js file. PoC: js var a = require"nuance-gulp-build-common" a.run"touch JHU"...
GHSA-8695-FR6H-9FQ8 Command Injection in nuance-gulp-build-common
All versions of package nuance-gulp-build-common are vulnerable to Command Injection via the index.js file. PoC: js var a = require"nuance-gulp-build-common" a.run"touch JHU"...
Arbitrary Command Execution
nuance-gulp-build-common is vulnerable to arbitrary command execution. The run function allows an attacker to execute arbitrary commands on the host OS...
nuance-gulp-build-common OS Command Injection Vulnerability
nuance-gulp-build-common is a package for npm. nuance-gulp-build-common suffers from an operating system command injection vulnerability that stems from vulnerability to command injection via the index.js file...
Command Injection in juanfran/gulp-scss-lint
Overview gulp-scss-lint is a Lint for your .scss files, this package is vulnerable to Command Injection. It is possible to inject arbitrary commands to the exec function located in src/command.js via the provided options. Proof of Concept by JHU System Security Lab var root =...
Vulnerability of the `exec` function in the gulp-scss-lint package from the NPM package manager, allowing attackers to execute arbitrary commands.
The vulnerability of the exec function in the src/command.js file of the gulp-scss-lint package exists because measures to eliminate special elements used in operating system commands have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
gulp-tape injection vulnerability
gulp-tape is a package that supports running Tape tests in Gulp. An injection vulnerability exists in gulp-tape 1.0.0 and earlier versions, which can be exploited by an attacker to execute arbitrary commands...
Remote Code Execution (RCE)
gulp-tape is susceptible to remote code execution RCE. The vulnerability exists as the flush function accepts the tapeProcess argument directly from the input using tapeBinaryFilepath without any sanitization...
gulp-scss-lint injection vulnerability
gulp-scss-lint is a configurable package of code cleaning tools. A security vulnerability exists in gulp-scss-lint 1.0.0 and earlier versions. An attacker can exploit the vulnerability to inject and execute arbitrary commands...
gulp-styledocco injection vulnerability
gulp-styledocco is a package for generating documentation from stylesheets and style guide documentation. A security vulnerability exists in gulp-styledocco 0.0.3 and earlier versions, which stems from the program failing to clean up the 'options' parameter. An attacker can exploit this...
