What is GHSA-795w-7426-m94j?

GHSA-795w-7426-m94j is a security advisory published by GitHub Security Advisories with Critical severity. stoqey/gnuplot is vulnerable to command injection

Which CVE IDs does GHSA-795w-7426-m94j cover?

GHSA-795w-7426-m94j covers the following CVE IDs: CVE-2021-33360. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-795w-7426-m94j?

GHSA-795w-7426-m94j has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-795w-7426-m94j?

GHSA-795w-7426-m94j affects 1 product, including: npm/@stoqey/gnuplot:\u003c= 0.0.3.

GHSA-795w-7426-m94jCriticalCVSS 9.8

stoqey/gnuplot is vulnerable to command injection

Vendor

GitHub Security Advisories

Published

March 10, 2023

Last Modified

March 15, 2023

🔗 CVE IDs covered (1)

CVE-2021-33360 →

📋 Description

An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_process, and/or filePath parameter(s).

🎯 Affected products1

npm/@stoqey/gnuplot:<= 0.0.3

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-33360
https://advisory.checkmarx.net/advisory/CX-2021-4811/
https://github.com/stoqey/gnuplot/blob/cd76060a15f58348baeef1c5fd867ce856515949/src/index.ts#L211-L217
https://github.com/advisories/GHSA-795w-7426-m94j