critical9.8
CVE-2020-28437
heroku-env susceptible to command injection
Impact
A command injection vulnerability affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | heroku-env | <= 0.2.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Heroku-Env Project | Heroku-Env | All versions |