OS Command Injection in gulkp-styledocco

CRITICO 9.8CVE-2020-7607 · GHSA-h33p-5j96-w8qh · SNYK-JS-GULPSTYLEDOCCO-560126 · Published 15/03/2020 · updated 17/06/2026

In breve

CVE-2020-7607 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda gulp-styledocco (gulp-styledocco project), gulp-styledocco.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.6%, superiore al 85.3% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
gulp-styledocco gulp-styledocco_project	`≤ 0.0.3`	No fix yet
gulp-styledocco npm	`≤ 0.0.3`	No fix yet

Description

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument options of the exports function in index.js can be controlled by users without any sanitization.

NVD description

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any sanitization.

References

nvd.nist.gov/vuln/detail/CVE-2020-7607 · ADVISORY
snyk.io/vuln/SNYK-JS-GULPSTYLEDOCCO-560126 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free