GHSA-xrjf-phvv-r4vr
Suggest an improvement- Source
- https://github.com/advisories/GHSA-xrjf-phvv-r4vr
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-xrjf-phvv-r4vr/GHSA-xrjf-phvv-r4vr.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-xrjf-phvv-r4vr
- Aliases
- Published
- 2022-02-27T00:00:15Z
- Modified
- 2023-11-01T04:57:12.855168Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L CVSS Calculator
- Summary
- Command injection in strapi
- Details
-
When creating a strapi app using npxcreate-strapi-app, we can inject arbitrary commands through the template cli argument as per the code in this particular link, this happens due to improper sanitization of user input.
- Database specific
{ "github_reviewed": true, "github_reviewed_at": "2022-03-01T21:42:15Z", "cwe_ids": [ "CWE-77", "CWE-78" ], "nvd_published_at": "2022-02-26T15:15:00Z", "severity": "MODERATE" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2022-0764
- https://github.com/strapi/strapi/issues/12879
- https://github.com/strapi/strapi/commit/2a3f5e988be6a2c7dae5ac22b9e86d579b462f4c
- https://github.com/strapi/strapi
- https://github.com/strapi/strapi/blob/master/packages/generators/app/lib/utils/fetch-npm-template.js#L13
- https://huntr.dev/bounties/001d1c29-805a-4035-93bb-71a0e81da3e5
- https://www.github.com/strapi/strapi/commit/2a3f5e988be6a2c7dae5ac22b9e86d579b462f4c
Affected packages
npm / strapi
Package
- Name
- strapi
- View open source insights on deps.dev
- Purl
- pkg:npm/strapi