monorepo-publish (>=0.1.0 <=0.1.9) potentially affected by CVE-2020-28423 via monorepo-build (>=0.1.0 <=0.1.9)

monorepo-build NPM version =0.1.0, =0.1.0, =0.1.9 Source cves: CVE-2020-28423 Source advisory: OSV:GHSA-5VRC-7JFR-4642...

CVE-2020-28423

creationtimestamp| type| source ---|---|--- 2022-08-02 18:17:59+00:00| seen| https://t.me/cibsecurity/47414...

CVE-2020-28423

This affects all versions of package monorepo-build...

CVE-2020-28423 Command Injection

This affects all versions of package monorepo-build...

CVE-2020-28423

CVE-2020-28423 affects all versions of the npm package monorepo-build. The connected sources describe a command-injection vulnerability in the package (notably in the publish function) with PoC examples showing how arguments can inject and execute arbitrary commands. Exploitation details are prov...

monorepo-publish (>=0.1.0 <=0.1.9) potentially affected by CVE-2020-28423 via monorepo-build (>=0.1.0 <=0.1.9)

monorepo-build NPM version =0.1.0, =0.1.0, =0.1.9 Source cves: CVE-2020-28423 Source advisory: SNYK:JS-MONOREPOBUILD-1050392...