Skip to content
OpenAdvisories
High · 7.4 CVE-2022-25853 EUVD-2023-0667GHSA-8h3g-hcwp-6hxq

semver-tags is vulnerable to Command Injection via the getGitTagsRemote function

Published Feb 6, 2023 · Updated Mar 25, 2025 · Assigned by snyk

Package: semver-tags Ecosystem: npm

Description

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization.

Affected products

VendorProductAffectedFixed
— semver-tags — —

Affected packages

EcosystemPackageAffectedFixedRecord
npm semver-tags <= 0.4.10 — GHSA-8h3g-hcwp-6hxq

References