CVE-2020-7735 - Command Injection

MEDIUM

Command Injection

Published Sep 25, 2020

6.6

MEDIUM

CVSS 3.1

EPSS 2.39%

The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

NG-Packagr

n/a

Version	Status	Constraints
unspecified	affected	<10.1.1

Ecosystem	Package	Introduced	Fixed
npm	ng-packagr	0	10.1.1

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1167		Advisory
https://github.com/advisories/GHSA-qm28-7hqv-wg5j		Advisory
https://github.com/ng-packagr/ng-packagr/commit/bda0fff3443301f252930a73fdc8fb9502de596d		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7735
https://snyk.io/vuln/SNYK-JS-NGPACKAGR-1012427		x_refsource_MISCThird Party Advisory