Description
All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization.
Remediation
References
https://hackerone.com/reports/808942
https://snyk.io/vuln/SNYK-JS-GITLOGPLUS-1315832
https://www.npmjs.com/package/gitlogplus
Related Vulnerabilities
CVE-2023-29514 Vulnerability in maven package org.xwiki.platform:xwiki-platform-administration-ui
CVE-2022-25854 Vulnerability in npm package @yaireo/tagify
CVE-2021-23421 Vulnerability in npm package merge-change
CVE-2021-26118 Vulnerability in maven package org.apache.activemq:artemis-openwire-protocol
CVE-2022-37616 Vulnerability in maven package org.webjars.npm:xmldom