Most recent entries from all

EUVD-2026-38304

fkie_cve-2020-8178

Insufficient input validation in npm package `jison` <= 0.4.18 may lead to OS command injection attacks.

Withdrawn: GHSA-vr9x-mm65-2438 — Command Injection in jison

Withdrawn by the publisher.

Affected: npm: jison

**Withdrawn:** This vulnerability is not present in the released npm package. Rather the vulnerable code is part of the repo, but not part of the package. See linked hackerone report for more details.

Insufficient input validation in npm package `jison` <= 0.4.18 may lead to OS command injection attacks.

gsd-2020-8178

OESA-2022-1546 — nodejs-jison security update

Affected: openEuler:20.03-LTS-SP1: nodejs-jison, openEuler:20.03-LTS-SP2: nodejs-jison, openEuler:20.03-LTS-SP3: nodejs-jison

A parser generator with Bison's API. Security Fix(es): Insufficient input validation in npm package `jison` <= 0.4.18 may lead to OS command injection attacks.(CVE-2020-8178)

UBUNTU-CVE-2020-8178

Affected: Ubuntu:18.04:LTS: node-jison, Ubuntu:20.04:LTS: node-jison, Ubuntu:22.04:LTS: node-jison, Ubuntu:24.04:LTS: node-jison, Ubuntu:25.10: node-jison, Ubuntu:26.04:LTS: node-jison

Insufficient input validation in npm package `jison` <= 0.4.18 may lead to OS command injection attacks.