CVE-2020-7607

The CVE-2020-7607 issue affects gulp-styledocco up to version 0.0.3, where the options parameter of the exports function in index.js can be controlled by users without sanitization, enabling command execution (OS Command Injection). Exploitation details or in-the-wild status are not provided in t...

CVE-2020-7607

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any sanitization...

CVE-2020-7607

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any sanitization...

CVE-2020-7605

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...

CVE-2020-7605

CVE-2020-7605 corresponds to a command-injection flaw in gulp-tape up to version 1.0.0. The vulnerability arises from injecting arbitrary commands via gulp-tape options, enabling potential remote code execution if an attacker can influence those options. Multiple connected sources (Red Hat CVE en...

CVE-2020-7605

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...

CVE-2020-7601

CVE-2020-7601 affects gulp-scss-lint up to version 1.0.0. The root cause is command injection through the exec function in src/command.js, allowing an attacker to execute arbitrary commands. Documented impact is remote command execution with high severity (NVD CVSS v3.1 base score 9.8; v2 7.5). M...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7605: Improper Neutralization of Special Elements used in an OS Command

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...

PT-2020-19650

Name of the Vulnerable Software and Affected Versions gulp-tape versions through 1.0.0 Description The issue allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of gulp-tape options. Recommendations For versions through 1.0.0, consider restricting the use o...

CVE-2020-7601: Improper Neutralization of Special Elements used in an OS Command

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7607: Improper Neutralization of Special Elements used in an OS Command

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any sanitization...

PT-2020-19651

Name of the Vulnerable Software and Affected Versions gulp-styledocco versions 0.0.3 and earlier Description The issue allows execution of arbitrary commands. The argument options of the exports function in index.js can be controlled by users without any sanitization. Recommendations For versions...

Command Injection

Overview gulp-styledocco is a StyleDocco plugin for gulp. Affected versions of this package are vulnerable to Command Injection. The argument options of the exports function in index.js can be controlled by users without any sanitization. PoC var root = require"gulp-styledocco"; var gulp =...

@instacarro/ic-model-admin (>=2.0.5, <=2.0.8), grommet-toolbox (>=0.1.3, <=0.2.12) +4 more potentially affected by CVE-2020-7605 via gulp-tape (>=0.0.3, <=1.0.0)

gulp-tape NPM version =0.0.3, =2.0.5, =0.1.3, =0.1.1, =0.1.5, =0.43.2 - sp-router-js 1.0.1 Source cves: CVE-2020-7605 Source advisory: SNYK:JS-GULPTAPE-560124...

Command Injection

Overview gulp-tape is a to run Tape tests in Gulp. Affected versions of this package are vulnerable to Command Injection. It is possible to inject arbitrary commands as part of gulp-tape options. PoC var root = require"gulp-tape"; var gulp = require"gulp"; var options = name: "& touch JHU.txt"...

@absolunet/nwayo-workflow (>=3.2.0, <=3.3.6), @londondevstudio/gush (>=0.9.0, <=0.10.0) +53 more potentially affected by CVE-2020-7601 via gulp-scss-lint (>=0.1.12, <=1.0.0)

gulp-scss-lint NPM version =0.1.12, =3.2.0, =0.9.0, =1.0.0-alpha, =1.1.1, =0.0.27, =0.0.33, =1.0.34, =1.1.54 - fear-core-dev 1.3.2 and more Source cves: CVE-2020-7601 Source advisory: SNYK:JS-GULPSCSSLINT-560114...

django-gulp (>=2.4.0, <=2.4.1), esrally (>=0.2.0, <=0.7.3) potentially affected by CVE-2019-18874 via psutil (4.1.0)

psutil PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on psutil and may be impacted: - django-gulp =2.4.0, =0.2.0, =0.7.3 Source cves: CVE-2019-18874 Source advisory: OSV:GHSA-QFC5-MCWQ-26Q8...

django-gulp (>=2.2.0, <=2.3.0) potentially affected by CVE-2019-18874 via psutil (3.3.0)

psutil PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on psutil and may be impacted: - django-gulp =2.2.0, =2.3.0 Source cves: CVE-2019-18874 Source advisory: OSV:GHSA-QFC5-MCWQ-26Q8...

dcicsnovault (2.0.0b0), django-gulp (>=2.5.0, <=2.5.1) +1 more potentially affected by CVE-2019-18874 via psutil (4.3.0)

psutil PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on psutil and may be impacted: - dcicsnovault 2.0.0b0 - django-gulp =2.5.0, =0.1.0, =0.1.3 Source cves: CVE-2019-18874 Source advisory: OSV:GHSA-QFC5-MCWQ-26Q8...