CVE-2023-26143: blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API

September 19, 2023 (updated November 7, 2023)

Versions of the package blamer before 1.0.4 is vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (–) to communicate the end of options.

References

gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9
github.com/advisories/GHSA-6f9p-g466-f8v8
github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3
nvd.nist.gov/vuln/detail/CVE-2023-26143
security.snyk.io/vuln/SNYK-JS-BLAMER-5731318

Detect and mitigate CVE-2023-26143 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →