cve.bz

CVE-2023-26143

9.1 criticalEPSS 1.1%

Critical (9.1) in blamer project blamer. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in blamer 1.0.4.

Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.

Severity

CVSS 3.1

9.1 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS
1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE
CWE-88
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-6f9p-g466-f8v8npmblamer<1.0.41.0.4

References

Check your stackJSON