GHSA-77qv-gh6f-pgh4LowCVSS 3.8

Command Injection in Limdu

Published
June 22, 2020
Last Modified
March 31, 2023

🔗 CVE IDs covered (1)

CVE-2020-4066 →

📋 Description

Impact

The trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

Patches

Patched in version 0.9.5.

Workarounds

Do not use trainBatch with classifiers that rely on shell execution, such as SVM Perf, SVM Linear or Adaboost

References

No

🎯 Affected products1

  • npm/limdu:<= 0.9.4

🔗 References (4)