Command injection in github-todos

Description

naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is directly used by the exec function.

Recommendation

No fix is available yet. Followings are affected versions:

<= 3.1.0

References

GHSA-792j-9wj3-j634
advisory.dw1.io
CVE-2021-44684
CWE-78
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Command injection in github-todos and gives you actionable findings to investigate.

Start a free scan

Related Issues

Command Injection in lodash - lodash-es - CVE-2021-23337
Command Injection in lodash - lodash-template - CVE-2021-23337
Command injection in launchpad - CVE-2021-23330
json-logic-js Command Injection vulnerability - CVE-2021-4329

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

See something that needs correcting? Let us knowUpdated September 07, 2023