diff --git a/advisories/github-reviewed/2023/06/GHSA-h42j-mrmp-9369/GHSA-h42j-mrmp-9369.json b/advisories/github-reviewed/2023/06/GHSA-h42j-mrmp-9369/GHSA-h42j-mrmp-9369.json index a7a596a0553..9c2fc1e959a 100644 --- a/advisories/github-reviewed/2023/06/GHSA-h42j-mrmp-9369/GHSA-h42j-mrmp-9369.json +++ b/advisories/github-reviewed/2023/06/GHSA-h42j-mrmp-9369/GHSA-h42j-mrmp-9369.json @@ -1,17 +1,21 @@ { "schema_version": "1.4.0", "id": "GHSA-h42j-mrmp-9369", - "modified": "2023-06-30T20:32:34Z", + "modified": "2024-10-30T18:00:09Z", "published": "2023-06-28T06:30:22Z", "aliases": [ "CVE-2023-26134" ], "summary": "git-commit-info vulnerable to Command Injection", - "details": "Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo() fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they control the hash content.", + "details": "Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo() fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject arguments to the git binary.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" } ], "affected": [ @@ -20,11 +24,6 @@ "ecosystem": "npm", "name": "git-commit-info" }, - "ecosystem_specific": { - "affected_functions": [ - "(git-commit-info)" - ] - }, "ranges": [ { "type": "ECOSYSTEM", @@ -60,6 +59,10 @@ { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-JS-GITCOMMITINFO-5740174" + }, + { + "type": "WEB", + "url": "https://www.npmjs.com/package/execa/v/5.1.0#execacommandcommand-options" } ], "database_specific": { @@ -67,7 +70,7 @@ "CWE-77", "CWE-78" ], - "severity": "CRITICAL", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-06-30T20:32:34Z", "nvd_published_at": "2023-06-28T05:15:10Z"