CVE-2020-4066 - Command Injection in Limdu trainBatch function

Back Back to CVE browser

HIGH

Command Injection in Limdu trainBatch function

Published Jun 22, 2020

7.2

HIGH

CVSS 3.1

EPSS 1.63%

Description

In Limdu before 0.95, the trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This has been patched in 0.95.

Affected products

Vendor Erelsgl Product Limdu Default
n/a
- Version
  < 0.95
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Erelsgl

Limdu

n/a

Version	Status	Constraints
< 0.95	affected	-

Ecosystem	Package	Introduced	Fixed
npm	limdu	0	0.9.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0470
Advisory
https://github.com/advisories/GHSA-77qv-gh6f-pgh4
Advisory
https://github.com/erelsgl/limdu/commit/03475a6a6bb253de6fad8f7f39cfb3504f11438d
https://github.com/erelsgl/limdu/security/advisories/GHSA-77qv-gh6f-pgh4
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-4066

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0470		Advisory
https://github.com/advisories/GHSA-77qv-gh6f-pgh4		Advisory
https://github.com/erelsgl/limdu/commit/03475a6a6bb253de6fad8f7f39cfb3504f11438d
https://github.com/erelsgl/limdu/security/advisories/GHSA-77qv-gh6f-pgh4		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-4066