Arbitrary Command Execution

nuance-gulp-build-common is vulnerable to arbitrary command execution. The run function allows an attacker to execute arbitrary commands on the host OS...

nuance-gulp-build-common OS Command Injection Vulnerability

nuance-gulp-build-common is a package for npm. nuance-gulp-build-common suffers from an operating system command injection vulnerability that stems from vulnerability to command injection via the index.js file...

PT-2021-11529

Name of the Vulnerable Software and Affected Versions: nuance-gulp-build-common affected versions not specified Description: The issue concerns Command Injection via the index.js file in the nuance-gulp-build-common package. A proof of concept PoC demonstrates the vulnerability by requiring the...

gulp-controlled-merge-json (0.2.1) potentially affected by CVE-2020-28268 via controlled-merge (1.1.0)

controlled-merge NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on controlled-merge and may be impacted: - gulp-controlled-merge-json 0.2.1 Source cves: CVE-2020-28268 Source advisory: MEND:CVE-2020-28268...

Command Injection in juanfran/gulp-scss-lint

Overview gulp-scss-lint is a Lint for your .scss files, this package is vulnerable to Command Injection. It is possible to inject arbitrary commands to the exec function located in src/command.js via the provided options. Proof of Concept by JHU System Security Lab var root =...

gulp-scss-lint exec Command Injection

The vulnerability of the exec function in the src/command.js file of the gulp-scss-lint package exists because measures to eliminate special elements used in operating system commands have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

gulp-tape injection vulnerability

gulp-tape is a package that supports running Tape tests in Gulp. An injection vulnerability exists in gulp-tape 1.0.0 and earlier versions, which can be exploited by an attacker to execute arbitrary commands...

Remote Code Execution (RCE)

gulp-tape is susceptible to remote code execution RCE. The vulnerability exists as the flush function accepts the tapeProcess argument directly from the input using tapeBinaryFilepath without any sanitization...

gulp-scss-lint injection vulnerability

gulp-scss-lint is a configurable package of code cleaning tools. A security vulnerability exists in gulp-scss-lint 1.0.0 and earlier versions. An attacker can exploit the vulnerability to inject and execute arbitrary commands...

gulp-styledocco injection vulnerability

gulp-styledocco is a package for generating documentation from stylesheets and style guide documentation. A security vulnerability exists in gulp-styledocco 0.0.3 and earlier versions, which stems from the program failing to clean up the 'options' parameter. An attacker can exploit this...

CVE-2020-7605

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7605

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7607

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any sanitization...

Design/Logic Flaw

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...

CVE-2020-7605

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...

Code injection

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7607

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any sanitization...