OS Command Injection in mversion · CVE-2020-7688 · GitHub Advisory Database · GitHub

OS Command Injection in mversion

Moderate severity GitHub Reviewed Published May 17, 2021 to the GitHub Advisory Database • Updated Feb 1, 2023

Package

mversion (npm)

Affected versions

<= 1.13.0

Patched versions

2.0.1

Description

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.

References

Published by the National Vulnerability Database

Jul 1, 2020

Reviewed May 11, 2021

Published to the GitHub Advisory Database May 17, 2021

Last updated Feb 1, 2023