Duplicate Advisory: pullit Command Injection vulnerability
High severity
GitHub Reviewed
Published
Mar 27, 2023
to the GitHub Advisory Database
•
Updated Mar 28, 2023
Withdrawn
This advisory was withdrawn on Mar 28, 2023
Description
Published by the National Vulnerability Database
Mar 27, 2023
Published to the GitHub Advisory Database
Mar 27, 2023
Reviewed
Mar 27, 2023
Withdrawn
Mar 28, 2023
Last updated
Mar 28, 2023
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-8px5-63x9-5c7p. This link is maintained to preserve external references.
Original Description
The pullit package before 1.4.0 for Node.js allows OS Command Injection because
eval()is used on an attacker-supplied Git branch name.References