Command Injection

Overview blamer is a tool for get information about author of code from version control system. Supports git and subversion. Affected versions of this package are vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to blamer. PoC var Root...

Node.js third-party modules: [blamer] RCE via insecure command formatting

I would like to report a RCE issue in the blamer module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: blamer version: 0.1.13 npm page: https://www.npmjs.com/package/blamer Module Description Blamer is a tool for get information about author of code...