https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:56:51 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-175565 EUVD-2026-175565 https://cve.radiocsirt.org/vuln/euvd-2026-175565 https://cve.radiocsirt.org/vuln/fkie_cve-2021-23352 <p>This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.</p> <p>This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-23352 https://cve.radiocsirt.org/vuln/ghsa-753c-phhg-cj29 <p><strong>Affected:</strong> npm: madge</p> <p>This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which, when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.</p> <p>### PoC ```js const madge = require(&#39;madge&#39;); madge(&#39;..&#39;, {graphVizPath: &#34;touch HELLO;&#34;}) .then((res) =&gt; res.svg()) .then((writtenImagePath) =&gt; { console.log(&#39;Image written to &#39; + writtenImagePath); }); ```</p> <p><strong>Affected:</strong> npm: madge</p> <p>This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which, when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.</p> <p>### PoC ```js const madge = require(&#39;madge&#39;); madge(&#39;..&#39;, {graphVizPath: &#34;touch HELLO;&#34;}) .then((res) =&gt; res.svg()) .then((writtenImagePath) =&gt; { console.log(&#39;Image written to &#39; + writtenImagePath); }); ```</p> https://cve.radiocsirt.org/vuln/ghsa-753c-phhg-cj29 https://cve.radiocsirt.org/vuln/gsd-2021-23352 gsd-2021-23352 https://cve.radiocsirt.org/vuln/gsd-2021-23352