From 4ecbb175a2695698af08ef8663dfccdb1eabc2a4 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 13 Sep 2023 17:36:47 +0000 Subject: [PATCH] Publish GHSA-f8fh-8rgm-227h --- .../2021/05/GHSA-f8fh-8rgm-227h/GHSA-f8fh-8rgm-227h.json | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/advisories/github-reviewed/2021/05/GHSA-f8fh-8rgm-227h/GHSA-f8fh-8rgm-227h.json b/advisories/github-reviewed/2021/05/GHSA-f8fh-8rgm-227h/GHSA-f8fh-8rgm-227h.json index b348ebec77f..d17e11ef5a0 100644 --- a/advisories/github-reviewed/2021/05/GHSA-f8fh-8rgm-227h/GHSA-f8fh-8rgm-227h.json +++ b/advisories/github-reviewed/2021/05/GHSA-f8fh-8rgm-227h/GHSA-f8fh-8rgm-227h.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-f8fh-8rgm-227h", - "modified": "2021-07-28T20:46:04Z", + "modified": "2023-09-13T17:35:35Z", "published": "2021-05-07T16:16:16Z", "aliases": [ "CVE-2020-7602" ], "summary": "OS Command Injection in node-prompt-here", - "details": "node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" function in file "linux/manager.js", which is required by the "index. process.env.NM_CLI" in the file "linux/manager.js". This function is used to construct the argument of function "execSync()", which can be controlled by users without any sanitization.", + "details": "node-prompt-here through 1.0.1 allows execution of arbitrary commands. The `runCommand()` is called by `getDevices()` function in file `linux/manager.js`, which is required by the `index. process.env.NM_CLI` in the file `linux/manager.js`. This function is used to construct the argument of function `execSync()`, which can be controlled by users without any sanitization.", "severity": [ { "type": "CVSS_V3", @@ -20,6 +20,11 @@ "ecosystem": "npm", "name": "node-prompt-here" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM",