Search
Find a vulnerability
Search criteria
Related vulnerabilities
BREW-COOKIECUTTER-CVE-20… (CVE-2022-24065)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:41 – Updated: 2026-09-09 23:48 – Source website
VLAI
Summary
Command Injection
Details
The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Severity
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"upstream_fixed_in": "2.1.1"
},
"package": {
"ecosystem": "Homebrew",
"name": "cookiecutter",
"purl": "pkg:brew/cookiecutter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.1_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "git",
"upstream_evidence": [
{
"ecosystem": "GIT",
"key": "https://github.com/cookiecutter/cookiecutter",
"name": "https://github.com/cookiecutter/cookiecutter",
"strategy": "git",
"subject_version": "2.7.1"
},
{
"ecosystem": "PyPI",
"key": "pkg:pypi/cookiecutter@2.7.1",
"name": "cookiecutter",
"strategy": "registry",
"subject_version": "2.7.1"
},
{
"ecosystem": "Debian",
"key": "Debian/cookiecutter",
"name": "cookiecutter",
"strategy": "distro"
},
{
"ecosystem": "GIT",
"key": "upstream:https://github.com/cookiecutter/cookiecutter",
"name": "https://github.com/cookiecutter/cookiecutter",
"strategy": "distro",
"subject_version": "2.7.1"
},
{
"ecosystem": "PyPI",
"key": "upstream:pkg:pypi/cookiecutter@2.7.1",
"name": "cookiecutter",
"strategy": "distro",
"subject_version": "2.7.1"
},
{
"ecosystem": "Ubuntu",
"key": "Ubuntu/cookiecutter",
"name": "cookiecutter",
"strategy": "distro"
}
]
},
"details": "The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.",
"id": "BREW-cookiecutter-CVE-2022-24065",
"modified": "2026-09-09T23:48:44Z",
"published": "2026-08-13T16:41:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cookiecutter/cookiecutter/releases/tag/2.1.1"
},
{
"type": "ADVISORY",
"url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24065.json"
},
{
"type": "ADVISORY",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G5TXC4JYTNGOUFMCXPZ6QKWEZN3URTAK/"
},
{
"type": "ADVISORY",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQKWT7SGFDCUPPLDIELTN7FVTHWDL5YK/"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24065"
},
{
"type": "ADVISORY",
"url": "https://snyk.io/vuln/SNYK-PYTHON-COOKIECUTTER-2414281"
},
{
"type": "FIX",
"url": "https://github.com/cookiecutter/cookiecutter/commit/fdffddb31fd2b46344dfa317531ff155e7999f77"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"type": "CVSS_V3"
}
],
"summary": "Command Injection",
"upstream": [
"CVE-2022-24065",
"GHSA-f4q6-9qm4-h8j4",
"PYSEC-2022-204",
"SNYK-PYTHON-COOKIECUTTER-2414281"
]
}
BREW-CRUFT-CVE-2022-24065 (GHSA-F4Q6-9QM4-H8J4)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:41 – Updated: 2026-09-17 19:38 – Source website
VLAI
Summary
OS Command Injection in cookiecutter
Details
The package cookiecutter before 2.1.1 is vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Severity
8.1 (High)
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "cookiecutter",
"resource_purl": "pkg:pypi/cookiecutter@2.7.1",
"upstream_fixed_in": "2.1.1"
},
"package": {
"ecosystem": "Homebrew",
"name": "cruft",
"purl": "pkg:brew/cruft"
},
"ranges": [
{
"events": [
{
"introduced": "2.9.0"
},
{
"fixed": "2.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/cookiecutter@2.7.1",
"name": "cookiecutter",
"resource": "cookiecutter",
"strategy": "registry",
"subject_version": "2.7.1"
}
]
},
"details": "The package cookiecutter before 2.1.1 is vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.",
"id": "BREW-cruft-CVE-2022-24065",
"modified": "2026-09-17T19:38:44Z",
"published": "2026-08-13T16:41:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24065"
},
{
"type": "WEB",
"url": "https://github.com/cookiecutter/cookiecutter/commit/fdffddb31fd2b46344dfa317531ff155e7999f77"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-f4q6-9qm4-h8j4"
},
{
"type": "PACKAGE",
"url": "https://github.com/cookiecutter/cookiecutter"
},
{
"type": "WEB",
"url": "https://github.com/cookiecutter/cookiecutter/releases/tag/2.1.1"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/cookiecutter/PYSEC-2022-204.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G5TXC4JYTNGOUFMCXPZ6QKWEZN3URTAK"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQKWT7SGFDCUPPLDIELTN7FVTHWDL5YK"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-COOKIECUTTER-2414281"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OS Command Injection in cookiecutter",
"upstream": [
"GHSA-f4q6-9qm4-h8j4",
"CVE-2022-24065",
"PYSEC-2022-204",
"SNYK-PYTHON-COOKIECUTTER-2414281"
]
}
PYSEC-2022-204
Vulnerability from pysec - Published: 2022-06-08 08:15 - Updated: 2022-06-08 10:35
VLAI
Details
The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Impacted products
| Name | purl | cookiecutter | pkg:pypi/cookiecutter |
|---|
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "cookiecutter",
"purl": "pkg:pypi/cookiecutter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "fdffddb31fd2b46344dfa317531ff155e7999f77"
}
],
"repo": "https://github.com/cookiecutter/cookiecutter",
"type": "GIT"
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1",
"0.2",
"0.2.1",
"0.3",
"0.4",
"0.5",
"0.6.0",
"0.6.1",
"0.6.2",
"0.6.3",
"0.6.4",
"0.7.0",
"0.7.1",
"0.7.2",
"0.8.0",
"0.9.0",
"0.9.1",
"1.0.0",
"1.1.0",
"1.2.0",
"1.2.1",
"1.3.0",
"1.4.0",
"1.5.0",
"1.5.1",
"1.6.0",
"1.7.0",
"1.7.1",
"1.7.2",
"1.7.3",
"2.1.0"
]
}
],
"aliases": [
"CVE-2022-24065",
"SNYK-PYTHON-COOKIECUTTER-2414281",
"GHSA-f4q6-9qm4-h8j4"
],
"details": "The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.",
"id": "PYSEC-2022-204",
"modified": "2022-06-08T10:35:31.256727Z",
"published": "2022-06-08T08:15:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://snyk.io/vuln/SNYK-PYTHON-COOKIECUTTER-2414281"
},
{
"type": "FIX",
"url": "https://github.com/cookiecutter/cookiecutter/commit/fdffddb31fd2b46344dfa317531ff155e7999f77"
},
{
"type": "WEB",
"url": "https://github.com/cookiecutter/cookiecutter/releases/tag/2.1.1"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-f4q6-9qm4-h8j4"
}
]
}