Description
Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name.
Remediation
References
https://github.com/notduncansmith/summit/issues/23
https://nodesecurity.io/advisories/315
Related Vulnerabilities
CVE-2019-15599 Vulnerability in maven package org.webjars.npm:tree-kill
CVE-2019-9514 Vulnerability in maven package io.netty:netty-codec-http2
CVE-2023-22457 Vulnerability in maven package org.xwiki.contrib:application-ckeditor-plugins
CVE-2019-14772 Vulnerability in maven package org.webjars.npm:verdaccio
CVE-2018-18853 Vulnerability in maven package io.spray:spray-json_2.11