What is GHSA-pjh3-jv7w-9jpr?

GHSA-pjh3-jv7w-9jpr is a security advisory published by GitHub Security Advisories with Critical severity. Command Injection in gm

Which CVE IDs does GHSA-pjh3-jv7w-9jpr cover?

GHSA-pjh3-jv7w-9jpr covers the following CVE IDs: CVE-2015-7982. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-pjh3-jv7w-9jpr?

GHSA-pjh3-jv7w-9jpr affects 1 product, including: npm/gm:\u003c= 1.20.0.

GHSA-pjh3-jv7w-9jprCritical

Command Injection in gm

Vendor

GitHub Security Advisories

Published

September 1, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2015-7982 →

📋 Description

Versions of gm prior to 1.21.1 are affected by a command injection vulnerability. The vulnerability is triggered when user input is passed into gm.compare(), which fails to sanitize input correctly before calling the graphics magic binary.

Recommendation

Update to version 1.21.1 or later.

🎯 Affected products1

npm/gm:<= 1.20.0

🔗 References (4)

https://github.com/aheckmann/gm/commit/5f5c77490aa84ed313405c88905eb4566135be31
https://www.npmjs.com/advisories/54
https://nvd.nist.gov/vuln/detail/CVE-2015-7982
https://github.com/advisories/GHSA-pjh3-jv7w-9jpr