Description
A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI.
Remediation
References
https://github.com/zowe/imperative/
Related Vulnerabilities
CVE-2022-0401 Vulnerability in npm package w-zip
CVE-2023-0842 Vulnerability in npm package xml2js
CVE-2022-38398 Vulnerability in maven package org.apache.xmlgraphics:batik-bridge
CVE-2023-26486 Vulnerability in maven package org.webjars.bowergithub.vega:vega
CVE-2023-40014 Vulnerability in npm package @openzeppelin/contracts-upgradeable