EUVD-2022-6466

Malicious code in bioql PyPI...

Command Injection

Overview gitblame is a package that uses git blame to find out who modified a file. Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 15 in lib/gitblame.js. PoC var a =require"gitblame"; a"& touch JHU",function Remediation There is no...