CVE-2023-26143 blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API
Attackers can execute arbitrary commands via argument injection in the blamer library's blameByFile API due to lack of input sanitization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-26143?
CVE-2023-26143 is a medium-severity command injection vulnerability in blamer, published on 19 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.
Weakness: CWE-88
Which versions are affected by CVE-2023-26143?
2 open source packages ship an affected version, including blamer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
blamer npm | All versions | 1.0.4 |
blamer npm | All versions | 1.0.4 |
Products include Blamer Project Blamer.
How do I fix CVE-2023-26143?
Upgrade blamer to 1.0.4 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-26143 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26143 exists.
Other vulnerabilities in blamer
Sources
Also known as GHSA-6f9p-g466-f8v8.