EUVD-2022-6579

Malicious code in bioql PyPI...

OS Command Injection

Heroku-env is vulnerable to OS command injection. The vulnerability is due to the function get that executes a shell command with unsanitized user input. An attacker can inject shell code using the app parameter, using the control operator & or && followed by an arbitrary command...

GHSA-JP45-65JW-94MJ heroku-env susceptible to command injection

A command injection vulnerability affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...

CVE-2020-28437

This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...

Code injection

This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...

CVE-2020-28437

CVE-2020-28437 affects all versions of the npm package heroku-env. The vulnerability is a command-injection flaw in the get() function, with the injection point in lib/get.js which is required by index.js. This allows unsanitized user input to lead to shell execution. Public sources (Veracode, GH...

CVE-2020-28437 Command Injection

This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...

npm heroku-env 命令注入漏洞

npm heroku-env is a package from npm USA. It is used to parse DATABASEURL from heroku configuration and split it into PG environment variables used by psql pgdump pgrestore and nodepostgres. A command injection vulnerability exists in versions of heroku-env prior to 2.0.2, which stems from the...

npm heroku-env 命令注入漏洞

npm heroku-env is a package from npm USA. It is used to parse DATABASEURL from heroku configurations and split it into PG environment variables used by psql pgdump pgrestore and nodepostgres. A command injection vulnerability exists in all versions of heroku-env, which stems from the presence of...

Command Injection

Overview heroku-env is a package that parse the DATABASEURL from your heroku config and split it out into the PG environment variables used by psql pgdump pgrestore and nodepostgres Affected versions of this package are vulnerable to Command Injection. The injection point is located in lib/get.js...