CVE-2020-7634

CVE-2020-7634 affects the npm package heroku-addonpool up to version 0.1.15. The vulnerability is a command injection flaw where the second parameter of the exported function HerokuAddonPool(id, app, opt) can be controlled by an attacker without sanitization. A PoC demonstrates exploiting this to...