Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

项目引用了shell-quote等667个开源组件,存在3个漏洞,建议升级 #345

Open
ghost opened this issue Mar 3, 2022 · 1 comment

Comments

@ghost
Copy link

ghost commented Mar 3, 2022

大佬,看你这个项目调用了shell-quote等667个开源组件,存在3个安全漏洞,建议你升级下。

漏洞标题:shell-quote 安全漏洞
漏洞编号:CVE-2021-42740
漏洞描述:
shell-quote是开源的一个软件包。用于解析和引用 shell 命令。
shell-quote package存在安全漏洞,攻击者可利用该漏洞可以植入任意代码从而执行相关操作。
影响范围:(∞, 1.7.3)
最小修复版本:1.7.3
引入路径:
[email protected]>[email protected]>[email protected]

另外2个漏洞 ,信息有点多我就不贴了,你自己看下完整报告:https://www.mfsec.cn/jr?p=af1a2c
你对这个issues有任何疑问可以回复我,我能看见哈。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants
and others