get-npm-package-version Command Injection vulnerability

심각 9.8CVE-2020-7795 · GHSA-4h66-vghf-xg5x · Published 02/08/2022 · updated 17/06/2026

요약

CVE-2020-7795은(는) get-npm-package-version (get-npm-package-version project), get-npm-package-version에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 4.0%, 전체 취약점의 90.5%보다 높음.
조치: 1.0.7 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
get-npm-package-version get-npm-package-version_project	`< 1.0.7`	`1.0.7`
get-npm-package-version npm	`< 1.0.7`	`1.0.7`

The package get-npm-package-version before 1.0.7 is vulnerable to Command Injection via the main function in index.js.

NVD description

The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.