critical9.8
CVE-2021-44684
Command injection in github-todos
Impact
naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is directly used by the exec function.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | github-todos | <= 3.1.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Github-Todos Project | Github-Todos | through 3.1.0 |