GHSA-C9M9-48PW-6MPV apiconnect-cli-plugins vulnerable to OS Command Injection

apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the pluginUri argument. PoC js var root = require"apiconnect-cli-plugins"; var payload = "& touch Song &"; root.pluginLoader.installPluginpayload, ""; The injection point is...

PT-2020-19669

Name of the Vulnerable Software and Affected Versions apiconnect-cli-plugins versions 6.0.1 and earlier Description The issue allows execution of arbitrary commands via the pluginUri argument, enabling command injection. This can be exploited by passing malicious input to the...

OS Command Injection

strapi is vulnerable to OS Command Injection. The vulnerability exists as it does not sanitize nor validate plugin names in installPlugin and uninstallPlugin...