CVE-2018-25083: pullit Command Injection vulnerability

March 27, 2023

The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.

References

github.com/advisories/GHSA-2w9p-xf5h-qwj3
github.com/jkup/pullit/commit/4fec455774ee08f4dce0ef2ef934ffcc37219bfb
nvd.nist.gov/vuln/detail/CVE-2018-25083
security.snyk.io/vuln/npm:pullit:20180214

Code Behaviors & Features

Detect and mitigate CVE-2018-25083 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →