EUVD-2023-0667

Malicious code in bioql PyPI...

CVE-2022-25853

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization...

@braira/changelog (>=1.0.0 <=1.0.4), grunt-ivantage-svn-changelog (>=0.3.0 <=0.4.1) potentially affected by CVE-2022-25853 via semver-tags (>=0.1.5 <=0.4.10)

semver-tags NPM version =0.1.5, =1.0.0, =0.3.0, =0.4.1 Source cves: CVE-2022-25853 Source advisory: OSV:GHSA-8H3G-HCWP-6HXQ...

GHSA-8H3G-HCWP-6HXQ semver-tags is vulnerable to Command Injection via the getGitTagsRemote function

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization...

semver-tags is vulnerable to Command Injection via the getGitTagsRemote function

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization...

CVE-2022-25853

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization...

Command injection

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization...

CVE-2022-25853

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization...

semver-tags 安全漏洞

semver-tags is jtrussell's personal developer's tool for obtaining semver tags for repos. A security vulnerability exists in semver-tags, which stems from improper cleaning of user input. An attacker can exploit this vulnerability to perform command injection via the getGitTagsRemote function...

@braira/changelog (>=1.0.0 <=1.0.4), grunt-ivantage-svn-changelog (>=0.3.0 <=0.4.1) potentially affected by CVE-2022-25853 via semver-tags (>=0.1.5 <=0.4.10)

semver-tags NPM version =0.1.5, =1.0.0, =0.3.0, =0.4.1 Source cves: CVE-2022-25853 Source advisory: SNYK:JS-SEMVERTAGS-3175612...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization. PoC js var r = require"semver-tags" opt = "repoType":"git","repoPath":"";touch EXPLOITED;"" finalCb = console.log ropt,finalCb Remediation There is...