You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.
mend-bolt-for-githubbot
changed the title
CVE-2022-21191 (High) detected in global-modules-path-2.1.0.tgz
CVE-2022-21191 (Critical) detected in global-modules-path-2.1.0.tgz
Dec 12, 2023
CVE-2022-21191 - Critical Severity Vulnerability
Vulnerable Library - global-modules-path-2.1.0.tgz
Returns path to globally installed package
Library home page: https://registry.npmjs.org/global-modules-path/-/global-modules-path-2.1.0.tgz
Path to dependency file: /cezerin/package.json
Path to vulnerable library: /node_modules/global-modules-path/package.json
Dependency Hierarchy:
Found in HEAD commit: c7838a0eac341bb8840bc645025fb2f8268cd42c
Found in base branch: master
Vulnerability Details
Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.
Publish Date: 2023-01-13
URL: CVE-2022-21191
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2023-01-13
Fix Resolution (global-modules-path): 3.0.0
Direct dependency fix Resolution (webpack-cli): 3.2.2
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: