What is GHSA-q6pj-jh94-5fpr?

GHSA-q6pj-jh94-5fpr is a security advisory published by GitHub Security Advisories with Critical severity. OS Command Injection in docker-compose-remote-api

Which CVE IDs does GHSA-q6pj-jh94-5fpr cover?

GHSA-q6pj-jh94-5fpr covers the following CVE IDs: CVE-2020-7606. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q6pj-jh94-5fpr?

GHSA-q6pj-jh94-5fpr has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-q6pj-jh94-5fpr?

GHSA-q6pj-jh94-5fpr affects 1 product, including: npm/docker-compose-remote-api:\u003c= 0.1.4.

GHSA-q6pj-jh94-5fprCriticalCVSS 9.8

OS Command Injection in docker-compose-remote-api

Vendor

GitHub Security Advisories

Published

May 7, 2021

Last Modified

September 11, 2023

🔗 CVE IDs covered (1)

CVE-2020-7606 →

📋 Description

docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within index.js of the package, the function exec(serviceName, cmd, fnStdout, fnStderr, fnExit) uses the variable serviceName which can be controlled by users without any sanitization.

🎯 Affected products1

npm/docker-compose-remote-api:<= 0.1.4

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2020-7606
https://snyk.io/vuln/SNYK-JS-DOCKERCOMPOSEREMOTEAPI-560125
https://github.com/advisories/GHSA-q6pj-jh94-5fpr