-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how the git function in git.ts executes 'git blame -w [path]' without validating the path or using POSIX '--' to separate options from arguments. The lack of sanitization allows argument injection if the path starts with '-'. The commit diff shows the function was modified to add an existsSync check, but the core issue was the insecure argument construction. The function's pre-patch version directly passed user input to execa without safeguards, making it clearly vulnerable to CWE-88.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| blamer | npm | < 1.0.4 | 1.0.4 |
A Semantic Attack on Google Gemini - Read the Latest Research