CVE-2023-26143

CVSS V2 None CVSS V3 None

Description

Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.

Overview

CVE ID
CVE-2023-26143

Assigner
snyk

Vulnerability Status
PUBLISHED

Published Version
2023-09-19T05:00:01.083Z

Last Modified Date
2023-09-19T05:00:01.083Z

Weakness Enumerations

CWE	URL
CWE-88	http://cwe.mitre.org/data/definitions/88.html

References

Reference URL	Reference Tags
https://security.snyk.io/vuln/SNYK-JS-BLAMER-5731318
https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9
https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-26143
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26143

History

Created	Old Value	New Value	Data Type	Notes
2024-06-24 23:25:46				Added to TrackCVE