CVE-2020-7688 - Command Injection

HIGH

Command Injection

Published Jul 1, 2020

8.4

HIGH

CVSS 3.1

EPSS 0.55%

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Mversion

n/a

Version	Status	Constraints
unspecified	affected	<2.0.1

Ecosystem	Package	Introduced	Fixed
npm	mversion	0	2.0.1

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0973		Advisory
https://github.com/418sec/huntr/pull/102		x_refsource_MISCExploitThird Party Advisory
https://github.com/advisories/GHSA-6m8p-4fxj-pgc2		Advisory
https://github.com/mikaelbr/mversion/commit/b7a8b32600e60759a7ad3921ec4a2750bf173482		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7688
https://snyk.io/vuln/SNYK-JS-MVERSION-573174		x_refsource_MISCExploitThird Party Advisory