OS Command Injection in gulkp-styledocco

KRITISCH 9.8CVE-2020-7607 · GHSA-h33p-5j96-w8qh · SNYK-JS-GULPSTYLEDOCCO-560126 · Published 15/03/2020 · updated 17/06/2026

Kurz gesagt

CVE-2020-7607 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in gulp-styledocco (gulp-styledocco project), gulp-styledocco.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.6%, höher als bei 85.3% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
gulp-styledocco gulp-styledocco_project	`≤ 0.0.3`	No fix yet
gulp-styledocco npm	`≤ 0.0.3`	No fix yet

Description

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument options of the exports function in index.js can be controlled by users without any sanitization.

NVD description

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any sanitization.

References

nvd.nist.gov/vuln/detail/CVE-2020-7607 · ADVISORY
snyk.io/vuln/SNYK-JS-GULPSTYLEDOCCO-560126 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free