EUVD-2021-1436

Malware in sbrugna...

@auto-canary/all-contributors (>=9.16.1-canary.undefined.13449.0 <=9.34.2-canary.1241.15885.0), @auto-canary/auto (>=9.16.1-canary.undefined.13449.0 <=9.34.2-canary.1241.15885.0) +23 more potentially affected by CVE-2021-23412 via gitlogplus (=3.1.7)

gitlogplus NPM version =3.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on gitlogplus and may be impacted: - @auto-canary/all-contributors =9.16.1-canary.undefined.13449.0, =9.16.1-canary.undefined.13449.0, =9.23.0-canary.1099.14362.0,...

Code Injection in domharrington/node-gitlog

Description The gitlogplus module is vulnerable against an arbitrary command injection issue which is made possible since some user-inputs are executed inside a command which doesn't have validations of any kind. POC 1. Create the following PoC file: js // poc.js var git = require'gitlogplus';...