CVE-2021-39135

"@npmcli/arborist", the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected...

@pkgjs/support (>=0.0.3, <=0.0.6), detect-node-support (1.4.1) +7 more potentially affected by CVE-2021-39135 via @npmcli/arborist (>=0.0.0, <=1.0.14)

@npmcli/arborist NPM version =0.0.0, =0.0.3, =1.0.0, =0.0.0, =0.3.4, =0.1.12, =2.1.0, =0.8.0-0, =1.0.3, =1.1.0 Source cves: CVE-2021-39135 Source advisory: MEND:CVE-2021-39135...

CVE-2021-39134

CVE-2021-39134 affects Node.js @npmcli/arborist. On case-insensitive file systems, Arborist could allow a local attacker to write arbitrary contents to arbitrary filesystem locations via a symlink dependency crafted across conflicting case names (e.g., pwn-a with foo:"file:/some/path" and pwn-b w...

@pkgjs/support (>=0.0.3, <=0.0.6), detect-node-support (1.4.1) +7 more potentially affected by CVE-2021-39134 via @npmcli/arborist (>=0.0.0, <=1.0.14)

@npmcli/arborist NPM version =0.0.0, =0.0.3, =1.0.0, =0.0.0, =0.3.4, =0.1.12, =2.1.0, =0.8.0-0, =1.0.3, =1.1.0 Source cves: CVE-2021-39134 Source advisory: MEND:CVE-2021-39134...

CVE-2021-39134

@npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder...

CVE-2021-39134 UNIX Symbolic Link (Symlink) Following in @npmcli/arborist

@npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder...

CVE-2021-39134

"@npmcli/arborist", the library that calculates dependency trees and manages the "nodemodules" folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected...

GHSA-2H3H-Q99F-3FHC @npmcli/arborist vulnerable to UNIX Symbolic Link (Symlink) Following

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution @npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and t...

@npmcli/arborist vulnerable to UNIX Symbolic Link (Symlink) Following

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution @npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and t...

GHSA-GMW6-94GG-2RC2 UNIX Symbolic Link (Symlink) Following in @npmcli/arborist

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution @npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and t...

PT-2021-5676

Name of the Vulnerable Software and Affected Versions @npmcli/arborist versions prior to 2.8.2 npm versions prior to 7.20.7 Description The issue is related to the @npmcli/arborist library, which calculates dependency trees and manages the node modules folder hierarchy for the npm command line...

CVE-2021-39135: UNIX Symbolic Link (Symlink) Following

@npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder...

CVE-2021-39134: UNIX Symbolic Link (Symlink) Following

@npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder...

WS-2021-0245

There exists a command injection vulnerability in "npmcli/git" versions 2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when "npmcli/git" is used to execute Git commands based on user controlled input. The impact of this issue is possible Arbitrar...

Arbitrary Command Injection due to Improper Command Sanitization

Overview Summary There exists a command injection vulnerability in @npmcli/git versions 2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when npmcli/git is used to execute Git commands based on user controlled input. The impact of this issue is...

Arbitrary Command Injection due to Improper Command Sanitization

Summary There exists a command injection vulnerability in npmcli/git versions 2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when npmcli/git is used to execute Git commands based on user controlled input. The impact of this issue is possible...

GHSA-HXWM-X553-X359 Arbitrary Command Injection due to Improper Command Sanitization

Summary There exists a command injection vulnerability in npmcli/git versions 2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when npmcli/git is used to execute Git commands based on user controlled input. The impact of this issue is possible...

PT-2021-24432

Name of the Vulnerable Software and Affected Versions: npmcli/git versions prior to 2.0.8 Description: The issue is related to a command injection vulnerability due to improper argument sanitization when executing Git commands based on user-controlled input. This may result in arbitrary shell...