Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    PYSEC-2022-204

    Vulnerability from pysec - Published: 2022-06-08 08:15 - Updated: 2022-06-08 10:35
    VLAI
    Details

    The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

    Impacted products
    Name purl
    cookiecutter pkg:pypi/cookiecutter
    Aliases
    To clipboard 

    {
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "cookiecutter",
        "purl": "pkg:pypi/cookiecutter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "fdffddb31fd2b46344dfa317531ff155e7999f77"
            }
          ],
          "repo": "https://github.com/cookiecutter/cookiecutter",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1",
        "0.2",
        "0.2.1",
        "0.3",
        "0.4",
        "0.5",
        "0.6.0",
        "0.6.1",
        "0.6.2",
        "0.6.3",
        "0.6.4",
        "0.7.0",
        "0.7.1",
        "0.7.2",
        "0.8.0",
        "0.9.0",
        "0.9.1",
        "1.0.0",
        "1.1.0",
        "1.2.0",
        "1.2.1",
        "1.3.0",
        "1.4.0",
        "1.5.0",
        "1.5.1",
        "1.6.0",
        "1.7.0",
        "1.7.1",
        "1.7.2",
        "1.7.3",
        "2.1.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-24065",
    "SNYK-PYTHON-COOKIECUTTER-2414281",
    "GHSA-f4q6-9qm4-h8j4"
  ],
  "details": "The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.",
  "id": "PYSEC-2022-204",
  "modified": "2022-06-08T10:35:31.256727Z",
  "published": "2022-06-08T08:15:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://snyk.io/vuln/SNYK-PYTHON-COOKIECUTTER-2414281"
    },
    {
      "type": "FIX",
      "url": "https://github.com/cookiecutter/cookiecutter/commit/fdffddb31fd2b46344dfa317531ff155e7999f77"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cookiecutter/cookiecutter/releases/tag/2.1.1"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-f4q6-9qm4-h8j4"
    }
  ]
}