console-blame (>=1.0.0 <=1.1.1), grunt-lintblame (>=0.1.0 <=0.3.5) +2 more potentially affected by CVE-2020-28434 via gitblame (>=0.1.0 <=0.1.1)

gitblame NPM version =0.1.0, =1.0.0, =0.1.0, =0.2.5, =0.9.5 - tch-lint-jshint =0.0.1 Source cves: CVE-2020-28434 Source advisory: OSV:GHSA-3486-RVXC-HRRJ...

CVE-2020-28434

CVE-2020-28434 affects all versions of the gitblame package. The root cause is a command injection in gitblame.js where the file parameter is not properly sanitized before using exec, enabling arbitrary code execution. Public documents corroborate that the vulnerability exists across all versions...