Description
All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization.
Remediation
References
https://hackerone.com/reports/808942
https://snyk.io/vuln/SNYK-JS-GITLOGPLUS-1315832
https://www.npmjs.com/package/gitlogplus
Related Vulnerabilities
CVE-2023-46122 Vulnerability in maven package org.scala-sbt:io_2.13
CVE-2022-21144 Vulnerability in npm package libxmljs
CVE-2018-18389 Vulnerability in maven package org.neo4j:neo4j-security-enterprise
CVE-2021-23433 Vulnerability in npm package algoliasearch-helper
CVE-2020-14967 Vulnerability in maven package org.webjars.bowergithub.kjur:jsrsasign