Command Injection in entitlements
High severity
GitHub Reviewed
Published
Sep 11, 2020
to the GitHub Advisory Database
•
Updated Jan 9, 2023
Description
Reviewed
Aug 31, 2020
Published to the GitHub Advisory Database
Sep 11, 2020
Last updated
Jan 9, 2023
Versions of
entitlements
prior to 1.3.0 are vulnerable to Command Injection. The package does not validate input on theentitlements
function and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.Recommendation
Upgrade to version 1.3.0 or later.
References