Description
A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Open Mainframe Project | Zowe | 1.16.0 – < 1.28.2, 2.0.0 – < 2.5.0 | 1.28.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @zowe/imperative | >= 5.0.0, < 5.7.1 | 5.7.1 | GHSA-6q8m-42qq-64r7 |
| npm | @zowe/imperative | < 4.18.10 | 4.18.10 | GHSA-6q8m-42qq-64r7 |