EUVD-2023-0792

Malicious code in bioql PyPI...

CVE-2022-25908

All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

CVE-2022-25908

CVE-2022-25908 affects the Node.js module create-choo-electron, with all versions vulnerable to Command Injection via the devInstall function due to improper input validation. Connected IBM advisories tie this to IBM Storage Ceph and IBM Maximo MAS deployments, describing feasible command executi...

PT-2023-12833 · Unknown · Create-Choo-Electron

Name of the Vulnerable Software and Affected Versions: create-choo-electron versions all Description: The issue arises from improper user-input sanitization, making all versions of the package susceptible to Command Injection via the devInstall function. Recommendations: For all versions, conside...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization. PoC js var root = require"create-choo-electron" root.devInstall"./","& touch JHU",function Remediation There is no fixed version for...