https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-24T09:05:42.556437+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-218769 EUVD-2026-218769 2026-10-24T09:05:42.559096+00:00 EUVD-2026-218769 https://cve.radiocsirt.org/vuln/fkie_cve-2018-25083 fkie_cve-2018-25083 2026-10-24T09:05:42.559127+00:00

The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.

 https://cve.radiocsirt.org/vuln/ghsa-8px5-63x9-5c7p GHSA-8px5-63x9-5c7p — pullit vulnerable to command injection 2026-10-24T09:05:42.559156+00:00

Affected: npm: pullit

Versions of `pullit` prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.

## Recommendation

Upgrade to version 1.4.0 or later.

## Credits

This vulnerability was discovered by @lirantal

 https://cve.radiocsirt.org/vuln/gsd-2018-25083 gsd-2018-25083 2026-10-24T09:05:42.559182+00:00 gsd-2018-25083