| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| effect | ≤ 1.0.4 | |
| effect | ≤ 1.0.4 |
This advisory has been withdrawn because the npm package effect, for which alerts were issued, does not correspond with https://github.com/Javascipt/effect, the repository with the vulnerable code. https://github.com/Javascipt/effect is not in any supported ecosystem.
Additionally, the CVE Numbering Authority that issued the CVE for CVE-2020-7624 has updated their advisory stating that "This was deemed not a vulnerability."
effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí