CVE-2023-26143

Published Sep 19, 2023

Last updated a year ago

CVSS critical 9.1

Overview

Description: Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.
Source: report@snyk.io
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Severity: CRITICAL

Weaknesses

nvd@nist.gov: CWE-88
report@snyk.io: CWE-88

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:blamer_project:blamer:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A8E6FC04-030F-4B2D-9484-213E324BBB7A",
            "versionEndExcluding": "1.0.4"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References