Arbitrary Command Execution

2023-04-0318:34:35

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

pullit

software

insecure

eval function

arbitrary commands

0.002 Low

EPSS

Percentile

54.9%

JSON

pullit is vulnerable to Arbitrary Command Execution. The vulnerability exists in index.js due to an insecure use of the eval function which allows an attacker to inject and execute arbitrary commands.

CPENameOperatorVersion
pullitle1.3.0
pullitle1.3.0

CPE	Name	Operator	Version
	pullit	le	1.3.0
	pullit	le	1.3.0

References

github.com/advisories/GHSA-8px5-63x9-5c7p

github.com/jkup/pullit/commit/4fec455774ee08f4dce0ef2ef934ffcc37219bfb

github.com/jkup/pullit/issues/23

0.002 Low

EPSS

Percentile

54.9%

JSON

Related for VERACODE:40025