Description
The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | pullit | < 1.4.0 | 1.4.0 | GHSA-8px5-63x9-5c7p |
Critical · 9.8
CVE-2018-25083
EUVD-2020-0906GHSA-8px5-63x9-5c7p
pullit vulnerable to command injection
Published Mar 27, 2023 · Updated Feb 24, 2025 · Assigned by mitre