CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7605

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...

CVE-2020-7605

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7605

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...

Code injection

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

Design/Logic Flaw

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...

CVE-2020-7607

The CVE-2020-7607 issue affects gulp-styledocco up to version 0.0.3, where the options parameter of the exports function in index.js can be controlled by users without sanitization, enabling command execution (OS Command Injection). Exploitation details or in-the-wild status are not provided in t...

CVE-2020-7607

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any sanitization...

CVE-2020-7605

CVE-2020-7605 corresponds to a command-injection flaw in gulp-tape up to version 1.0.0. The vulnerability arises from injecting arbitrary commands via gulp-tape options, enabling potential remote code execution if an attacker can influence those options. Multiple connected sources (Red Hat CVE en...

CVE-2020-7605

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...

CVE-2020-7601

CVE-2020-7601 affects gulp-scss-lint up to version 1.0.0. The root cause is command injection through the exec function in src/command.js, allowing an attacker to execute arbitrary commands. Documented impact is remote command execution with high severity (NVD CVSS v3.1 base score 9.8; v2 7.5). M...

Command Injection

Overview gulp-styledocco is a StyleDocco plugin for gulp. Affected versions of this package are vulnerable to Command Injection. The argument options of the exports function in index.js can be controlled by users without any sanitization. PoC var root = require"gulp-styledocco"; var gulp =...

@instacarro/ic-model-admin (>=2.0.5, <=2.0.8), grommet-toolbox (>=0.1.3, <=0.2.12) +4 more potentially affected by CVE-2020-7605 via gulp-tape (>=0.0.3, <=1.0.0)

gulp-tape NPM version =0.0.3, =2.0.5, =0.1.3, =0.1.1, =0.1.5, =0.43.2 - sp-router-js 1.0.1 Source cves: CVE-2020-7605 Source advisory: SNYK:JS-GULPTAPE-560124...

Command Injection

Overview gulp-tape is a to run Tape tests in Gulp. Affected versions of this package are vulnerable to Command Injection. It is possible to inject arbitrary commands as part of gulp-tape options. PoC var root = require"gulp-tape"; var gulp = require"gulp"; var options = name: "& touch JHU.txt"...

@absolunet/nwayo-workflow (>=3.2.0, <=3.3.6), @londondevstudio/gush (>=0.9.0, <=0.10.0) +53 more potentially affected by CVE-2020-7601 via gulp-scss-lint (>=0.1.12, <=1.0.0)

gulp-scss-lint NPM version =0.1.12, =3.2.0, =0.9.0, =1.0.0-alpha, =1.1.1, =0.0.27, =0.0.33, =1.0.34, =1.1.54 - fear-core-dev 1.3.2 and more Source cves: CVE-2020-7601 Source advisory: SNYK:JS-GULPSCSSLINT-560114...

anione (>=1.2.0, <=1.2.7), gulp-imageoptim (0.1.0) potentially affected by CVE-2016-10596 via imageoptim (>=0.3.4, <=0.4.2)

imageoptim NPM version =0.3.4, =1.2.0, =1.2.7 - gulp-imageoptim 0.1.0 Source cves: CVE-2016-10596 Source advisory: OSV:GHSA-MM7H-323R-9P4G...

backender (>=0.0.1, <=0.0.7), gulp-backender (>=0.0.4, <=0.0.5) potentially affected by CVE-2016-10604 via dalek-browser-chrome (0.0.11)

dalek-browser-chrome NPM version 0.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on dalek-browser-chrome and may be impacted: - backender =0.0.1, =0.0.4, =0.0.5 Source cves: CVE-2016-10604 Source advisory: OSV:GHSA-6Q8Q-RVF4-M4PG...

gulp-haxe (>=0.3.0, <=0.4.5) potentially affected by CVE-2016-10692 via haxeshim (>=0.5.6, <=0.6.3)

haxeshim NPM version =0.5.6, =0.3.0, =0.4.5 Source cves: CVE-2016-10692 Source advisory: OSV:GHSA-CR6C-85FH-CQPG...