Description
Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name.
Remediation
References
https://github.com/notduncansmith/summit/issues/23
https://nodesecurity.io/advisories/315
Related Vulnerabilities
CVE-2019-10379 Vulnerability in maven package org.jenkins-ci.plugins:gcm-notification
CVE-2021-32012 Vulnerability in npm package xlsx
CVE-2017-1000043 Vulnerability in maven package org.webjars.npm:mapbox.js
CVE-2020-9489 Vulnerability in maven package org.apache.tika:tika-parsers
CVE-2023-46122 Vulnerability in maven package org.scala-sbt:io_2.12