CVE-2020-7640

Katalog CVE

CVSS 9.8 · Critical EPSS 2,1%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada pixlcore pixl-class. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization.

Rincian

Terbit di NVD

27 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 81,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://snyk.io/vuln/SNYK-JS-PIXLCLASS-564968 patch · advisory pihak ketiga
• https://github.com/jhuckaby/pixl-class/commit/47677a3638e3583e42f3a05cc7f0b30293d2acc8 patch · advisory pihak ketiga
• https://github.com/jhuckaby/pixl-class/commit/47677a3638e3583e42f3a05cc7f0b30293d2acc8%2C