Withdrawn Advisory: OS Command Injection in effect

CRITICO 9.8CVE-2020-7624 · GHSA-6hr9-4692-fch9 · Published 02/04/2020 · updated 17/06/2026

In breve

CVE-2020-7624 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda effect (effect project), effect.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 4.2%, superiore al 91.1% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
effect effect_project	`≤ 1.0.4`	No fix yet
effect npm	`≤ 1.0.4`	No fix yet

Description

Withdrawn Advisory

This advisory has been withdrawn because the npm package effect, for which alerts were issued, does not correspond with https://github.com/Javascipt/effect, the repository with the vulnerable code. https://github.com/Javascipt/effect is not in any supported ecosystem.

Additionally, the CVE Numbering Authority that issued the CVE for CVE-2020-7624 has updated their advisory stating that "This was deemed not a vulnerability."

Original Description

effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.

NVD description

effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.

References

nvd.nist.gov/vuln/detail/CVE-2020-7624 · ADVISORY
Javascipt/effect · WEB
snyk.io/vuln/SNYK-JS-EFFECT-564256 · WEB
Javascipt/effect

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free