CVE-2023-26143

Katalog CVE

CVSS 9.1 · Critical EPSS 1,1%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada blamer project blamer. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.

Rincian

Terbit di NVD

19 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3 patch
• https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9 exploit · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-BLAMER-5731318 exploit · advisory pihak ketiga