Description
The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.
Remediation
References
https://github.com/jkup/pullit/commit/4fec455774ee08f4dce0ef2ef934ffcc37219bfb
https://security.snyk.io/vuln/npm:pullit:20180214
Related Vulnerabilities
CVE-2019-10754 Vulnerability in maven package org.apereo.cas:cas-server-core-services-api
CVE-2023-5571 Vulnerability in npm package @vrite/sdk
CVE-2023-6293 Vulnerability in npm package sequelize-typescript
CVE-2023-35926 Vulnerability in npm package @backstage/plugin-scaffolder-backend
CVE-2018-8012 Vulnerability in maven package org.apache.zookeeper:zookeeper