Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

standard-version

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratednpmAmendedPublished

    Command Injection in standard-version

    GHSA-7xcx-6wjh-7xp2

    Affected
    • npm standard-version < 8.0.1
    Fixed in
    8.0.1· Vendor fix available
    Issue
    GitHub Security Lab (GHSL) Vulnerability Report: GHSL-2020-111 The GitHub Security Lab team has identified a potential security vulnerability in standard-version. Summary The standardVersion function has a command injection vulnerability. Clients of the standard-version library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. Product Standard Version Tested Version Commit 2f04ac8 Details Issue 1: Command injection in standardVersion The following proof-of-concept illustrates the vulnerability. First install Standard Version and create an empty git repo to run the PoC in: Now create a file with the following contents: and run it: Notice that a file named exploit has been created. This vulnerability is similar to command injection vulnerabilities that have been found in other Javascript libraries. Here are some examples: CVE-2020-7646, CVE-2020-7614, CVE-2020-7597, CVE-2019-10778, CVE-2019-10776, CVE-2018-16462, CVE-2018-16461,…

    Recommended action: Upgrade to 8.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →