critical9.8
CVE-2021-23412
Command injection in gitlogplus
Impact
All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | gitlogplus | <= 3.1.7 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gitlogplus Project | Gitlogplus | Versions 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7 |