The @mborne/extract library, versions before 0.2.1, can be tricked into executing arbitrary system commands when an attacker controls the archivePath or targetDir settings. This could…
Too many irrelevant or confusing CVEs? Use stackflag.com
#mborne #CVE #infosec
The @mborne/extract library, versions before 0.2.1, can be tricked into executing arbitrary system commands when an attacker controls the archivePath or targetDir settings. This could…
Too many irrelevant or confusing CVEs? Use stackflag.com
#mborne #CVE #infosec
Will later have to test whether it's building the executable for the correct kind of distribution in the archive step.
Will later have to test whether it's building the executable for the correct kind of distribution in the archive step.