CVE-2021-23352 in madge

Resumen

por MITRE • 2021-03-10

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsable: Snyk
• Reservar: 2021-01-08
• Divulgación: 2021-03-10
• Moderación: aceptado
• Artículo: VDB-170889
• CPE: listo
• CWE: CWE-89 (confirmado)
• CVSS: 9.8 (NVD)
• EPSS: 0.02057
• KEV: no
• Actividades: muy bajo

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2021-23352
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-23352
• CVE Details: https://www.cvedetails.com/cve/CVE-2021-23352/