OS Command Injection

madge is vulnerable to OS command injection. An attacker is able to inject and execute arbitrary OS commands via the graphVizPath option parameter...

CVE-2021-23352

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image, .svg or .dot functions are called, is executed by the childprocess.exec function...

CVE-2021-23352: Improper Neutralization of Special Elements used in an SQL Command

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image, .svg or .dot functions are called, is executed by the childprocess.exec function...

PT-2021-15454

Name of the Vulnerable Software and Affected Versions madge versions prior to 4.0.1 Description The issue affects the madge package, allowing an attacker to specify a custom Graphviz path via the graphVizPath option parameter. When the .image, .svg, or .dot functions are called, the specified pat...