Executive brief
blamer is a Node.js library that analyzes and formats code authorship information. A code injection vulnerability allows attackers to execute arbitrary code remotely when user-controlled input is processed by the library, potentially compromising servers or applications that depend on blamer.
Technical details
A code injection vulnerability (CWE-94) exists in blamer version 1.0.0 and earlier where unsanitized user input is evaluated or executed as code. The vulnerability is remotely exploitable without requiring authentication or user interaction (CVSS vector AV:N/AC:L/PR:N/UI:N). An attacker can achieve remote code execution by providing malicious input that the library fails to properly sanitize before execution. The vulnerability was fixed in version 1.0.1.
Affected products
- npm blamer 1.0.0 and earlier
Timeline
- 2020-03-20: disclosed
- 2021-05-06: advisory
- 2021-05-06: patched: Fixed in version 1.0.1