CVE-2021-23352 in madge

Sumário

de MITRE • 10/03/2021

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsável: Snyk
• Reservar: 08/01/2021
• Divulgação: 10/03/2021
• Moderação: aceite
• Entrada: VDB-170889
• CPE: pronto
• CWE: CWE-89 (confirmado)
• CVSS: 9.8 (NVD)
• EPSS: 0.02057
• KEV: não
• Atividades: muito baixo

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2021-23352
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-23352
• CVE Details: https://www.cvedetails.com/cve/CVE-2021-23352/