Command injection in github-todos

CRITICO 9.8CVE-2021-44684 · GHSA-792j-9wj3-j634 · Published 07/12/2021 · updated 17/06/2026

In breve

CVE-2021-44684 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda github-todos (github-todos project), github-todos.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.6%, superiore al 85.3% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
github-todos github-todos_project	`≤ 3.1.0`	No fix yet
github-todos npm	`≤ 3.1.0`	No fix yet

Description

naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is directly used by the exec function.

NVD description

naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is directly used by the exec function.

References

nvd.nist.gov/vuln/detail/CVE-2021-44684 · ADVISORY
dwisiswant0/advisory · WEB
advisory.dw1.io/5 · WEB
naholyr/github-todos · Issue Tracking

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free