Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security Vulnerability: Local Code/OS Command Execution in Commander.js parse() Method #2110

Closed
adominguezepiuse opened this issue Dec 18, 2023 · 2 comments
Closed

Security Vulnerability: Local Code/OS Command Execution in Commander.js parse() Method #2110

adominguezepiuse opened this issue Dec 18, 2023 · 2 comments

Comments

@adominguezepiuse
Copy link

adominguezepiuse commented Dec 18, 2023 •
edited by shadowspawn

Description
@shadowspawn
Copy link
Collaborator

shadowspawn commented Dec 18, 2023 •
edited

Thanks for the contact, but please see https://github.com/tj/commander.js/blob/master/SECURITY.md#reporting-a-vulnerability for responsibly reporting a security vulnerability.

To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.

@shadowspawn
Copy link
Collaborator

shadowspawn commented Feb 16, 2024 •
edited

This issue was responsibly reported by the Checkmarx Application Security Research Team. It was fixed in v2.20.3 (#1074) and v3.0.2(#1056).

The Checkmarx vulnerability library lists this as: https://devhub.checkmarx.com/cve-details/Cx435a6fda-ca38/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@shadowspawn @adominguezepiuse