What is GHSA-qjg4-w4c6-f6c6?

GHSA-qjg4-w4c6-f6c6 is a security advisory published by GitHub Security Advisories with High severity. Command injection in mversion

Which CVE IDs does GHSA-qjg4-w4c6-f6c6 cover?

GHSA-qjg4-w4c6-f6c6 covers the following CVE IDs: CVE-2020-4059. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qjg4-w4c6-f6c6?

GHSA-qjg4-w4c6-f6c6 has a CVSS v3 base score of 7.3, published by GitHub Security Advisories.

Which products are affected by GHSA-qjg4-w4c6-f6c6?

GHSA-qjg4-w4c6-f6c6 affects 1 product, including: npm/mversion:\u003c 2.0.0.

GHSA-qjg4-w4c6-f6c6HighCVSS 7.3

Command injection in mversion

Vendor

GitHub Security Advisories

Published

June 18, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2020-4059 →

📋 Description

Impact

This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

Patches

Patched by version 2.0.0. Previous releases are deprecated in npm.

Workarounds

Make sure to escape git commit messages when using the commitMessage option for the update function.

🎯 Affected products1

npm/mversion:< 2.0.0

🔗 References (4)

https://github.com/mikaelbr/mversion/security/advisories/GHSA-qjg4-w4c6-f6c6
https://github.com/mikaelbr/mversion/commit/6c76c9efd27c7ff5a5c6f187e8b7a435c4722338
https://nvd.nist.gov/vuln/detail/CVE-2020-4059
https://github.com/advisories/GHSA-qjg4-w4c6-f6c6