Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:npm/strapi@3.0.0-beta.17.8
Typenpm
Namespace
Namestrapi
Version3.0.0-beta.17.8
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version3.6.9
Latest_non_vulnerable_version4.10.8
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-bpbf-fj8g-5ueg
vulnerability_id VCID-bpbf-fj8g-5ueg
summary 
Duplicate Advisory: OS Command Injection in Strapi
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9p2w-rmx4-9mw7. This link is maintained to preserve external references.

### Original Description
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
references
0
reference_url https://bittherapy.net/post/strapi-framework-remote-code-execution
reference_id
reference_type
scores
url https://bittherapy.net/post/strapi-framework-remote-code-execution
1
reference_url https://github.com/strapi/strapi
reference_id
reference_type
scores
url https://github.com/strapi/strapi
2
reference_url https://github.com/strapi/strapi/pull/4636
reference_id
reference_type
scores
url https://github.com/strapi/strapi/pull/4636
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-19609
reference_id CVE-2019-19609
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2019-19609
4
reference_url https://github.com/advisories/GHSA-49vv-6q7q-w5cf
reference_id GHSA-49vv-6q7q-w5cf
reference_type
scores
url https://github.com/advisories/GHSA-49vv-6q7q-w5cf
fixed_packages
0
url pkg:npm/strapi@3.0.0-beta.17.8
purl pkg:npm/strapi@3.0.0-beta.17.8
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/strapi@3.0.0-beta.17.8
aliases GHSA-49vv-6q7q-w5cf
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bpbf-fj8g-5ueg
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:npm/strapi@3.0.0-beta.17.8