What is GHSA-6m8p-4fxj-pgc2?

GHSA-6m8p-4fxj-pgc2 is a security advisory published by GitHub Security Advisories with Medium severity. OS Command Injection in mversion

Which CVE IDs does GHSA-6m8p-4fxj-pgc2 cover?

GHSA-6m8p-4fxj-pgc2 covers the following CVE IDs: CVE-2020-7688. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6m8p-4fxj-pgc2?

GHSA-6m8p-4fxj-pgc2 has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

Which products are affected by GHSA-6m8p-4fxj-pgc2?

GHSA-6m8p-4fxj-pgc2 affects 1 product, including: npm/mversion:\u003c= 1.13.0.

GHSA-6m8p-4fxj-pgc2MediumCVSS 7.8

OS Command Injection in mversion

Vendor

GitHub Security Advisories

Published

May 17, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-7688 →

📋 Description

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.

🎯 Affected products1

npm/mversion:<= 1.13.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-7688
https://github.com/418sec/huntr/pull/102
https://github.com/mikaelbr/mversion/commit/b7a8b32600e60759a7ad3921ec4a2750bf173482
https://snyk.io/vuln/SNYK-JS-MVERSION-573174
https://github.com/advisories/GHSA-6m8p-4fxj-pgc2