Description
Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HackerOne | summit node module | >=0.1.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | summit | >= 0.1.0, <= 0.1.22 | — | GHSA-cwcp-6c48-fm7m |