Advisories for Npm/Hashbrown-Cms package

2022

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field.