-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability is explicitly located in line 15 of lib/gitblame.js where 'exec('git blame ' + filename)' is called. The code directly interpolates user-controlled filename input into a system command without proper sanitization or parameterization. This matches the CWE-77 command injection pattern where untrusted data flows into command execution contexts. The provided PoC demonstrates exploitability by passing '& touch JHU' as input to trigger arbitrary command execution.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gitblame | npm | <= 0.1.1 |
KEV Misses 88% of Exploited CVEs- Get the report