| Package | Affected versions | Patched versions |
|---|---|---|
| jison | ≤ 0.4.18 | |
| jison | ≤ 0.4.18 |
Withdrawn: This vulnerability is not present in the released npm package. Rather the vulnerable code is part of the repo, but not part of the package. See linked hackerone report for more details.
Insufficient input validation in npm package jison <= 0.4.18 may lead to OS command injection attacks.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free