CVE-2020-7615

EUVD-2021-2432
fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand()', located within 'lib/rep.js#63' can be controlled by users without any sanitization to inject arbitrary commands.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 64%
Affected Products (NVD)
VendorProductVersion
fsa_projectfsa
𝑥
≤ 0.5.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/gregof/fsa/blob/master/lib/rep.js#L12
https://snyk.io/vuln/SNYK-JS-FSA-564118
https://github.com/gregof/fsa/blob/master/lib/rep.js#L12
https://snyk.io/vuln/SNYK-JS-FSA-564118