Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXY4djgtNjg1OS1xeG00

Arbitrary shell command execution in logkitty

Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1.

Permalink: https://github.com/advisories/GHSA-v8v8-6859-qxm4
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXY4djgtNjg1OS1xeG00
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 4 years ago
Updated: over 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00534
EPSS Percentile: 0.77004

Identifiers: GHSA-v8v8-6859-qxm4, CVE-2020-8149
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-8149
• https://github.com/zamotany/logkitty/pull/18
• https://github.com/zamotany/logkitty/commit/ef2f673e25c629544dd3de6429999318447dd6bf
• https://hackerone.com/reports/825729
• https://github.com/advisories/GHSA-v8v8-6859-qxm4

Repository: https://github.com/zamotany/logkitty
Blast Radius: 52.9

Affected Packages