6 matches found
jsii-diff: Command Injection via npm: package argument
Summary jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. An issue exists where specially formatted command line arguments can be used to execute shell commands via this tool. Impa...
CLSA-2026-1780447848 TuxCare security update for diff (1 CVE)
TuxCare rebuilt diff to address 1 CVE. Fixed in 3.5.0-tuxcare.1...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via the git diff process. An attacker can overwrite critical files and disrupt service availability by supplying crafted input that bypasses directory restrictions. Details A Directory Traversal attack also known as...
Cross-site Scripting (XSS)
Overview @jupyterlab/git is an A JupyterLab extension for version control using git Affected versions of this package are vulnerable to Cross-site Scripting XSS in the createHeader method. An attacker can execute arbitrary JavaScript in another user's browser session by crafting a malicious...
Regular Expression Denial of Service
Overview Affected versions of diff are vulnerable to Regular Expression Denial of Service ReDoS. This can cause an impact of about 10 seconds matching time for data 48K characters long. Recommendation Upgrade to 3.5.0 or later. References - WhiteSource Advisory - Snyk Advisory - GitHub Advisory...
