EUVD-2023-0595

Malicious code in bioql PyPI...

CVE-2022-25906

All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function...

Command Injection

is-http2 is vulnerable to Command Injection. The vulnerability exists in the Promise function of index.js due to missing input sanitization which allows an attacker to inject and execute arbitrary commands into the system...

is-http2 vulnerable to Improper Input Validation

All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function...

grunt-yellowlabtools (>=0.0.1 <=1.2.1), install-is (>=1.4.0 <=1.4.2) +3 more potentially affected by CVE-2022-25906 via is-http2 (>=1.0.4 <=1.2.0)

is-http2 NPM version =1.0.4, =0.0.1, =1.4.0, =1.0.0, =1.10.0, =1.13.4 Source cves: CVE-2022-25906 Source advisory: OSV:GHSA-2275-RPF5-XV8H...

CVE-2022-25906

All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function...

CVE-2022-25906

CVE-2022-25906 affects the JavaScript package is-http2. The vulnerability is a Command Injection in the isH2-related handling due to missing input sanitization in the module’s code (index.js). Several sources describe that all versions are vulnerable and that using the sandboxed isH2 path does no...

CVE-2022-25906

All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function...

grunt-yellowlabtools (>=0.0.1 <=1.2.1), install-is (>=1.4.0 <=1.4.2) +3 more potentially affected by CVE-2022-25906 via is-http2 (>=1.0.4 <=1.2.0)

is-http2 NPM version =1.0.4, =0.0.1, =1.4.0, =1.0.0, =1.10.0, =1.13.4 Source cves: CVE-2022-25906 Source advisory: SNYK:JS-ISHTTP2-3153878...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function. PoC javascript var root = require"is-http2" root"./",openssl:"touch JHU" Remediation There is no fixed version for...