https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 09:05:41 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-218769 EUVD-2026-218769 https://cve.radiocsirt.org/vuln/euvd-2026-218769 https://cve.radiocsirt.org/vuln/fkie_cve-2018-25083 <p>The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.</p> <p>The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-25083 https://cve.radiocsirt.org/vuln/ghsa-8px5-63x9-5c7p <p><strong>Affected:</strong> npm: pullit</p> <p>Versions of `pullit` prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.</p> <p>## Recommendation</p> <p>Upgrade to version 1.4.0 or later.</p> <p>## Credits</p> <p>This vulnerability was discovered by @lirantal</p> <p><strong>Affected:</strong> npm: pullit</p> <p>Versions of `pullit` prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.</p> <p>## Recommendation</p> <p>Upgrade to version 1.4.0 or later.</p> <p>## Credits</p> <p>This vulnerability was discovered by @lirantal</p> https://cve.radiocsirt.org/vuln/ghsa-8px5-63x9-5c7p https://cve.radiocsirt.org/vuln/gsd-2018-25083 gsd-2018-25083 https://cve.radiocsirt.org/vuln/gsd-2018-25083