get-npm-package-version Command Injection vulnerability

CRITICO 9.8CVE-2020-7795 · GHSA-4h66-vghf-xg5x · Published 02/08/2022 · updated 17/06/2026

In breve

CVE-2020-7795 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda get-npm-package-version (get-npm-package-version project), get-npm-package-version.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 4.0%, superiore al 90.5% delle vulnerabilità.
Correzione: aggiornare a 1.0.7 o successiva.

Package	Affected versions	Patched versions
get-npm-package-version get-npm-package-version_project	`< 1.0.7`	`1.0.7`
get-npm-package-version npm	`< 1.0.7`	`1.0.7`

The package get-npm-package-version before 1.0.7 is vulnerable to Command Injection via the main function in index.js.

NVD description

The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.