Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:npm/renovate@42.40.2
Typenpm
Namespace
Namerenovate
Version42.40.2
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version42.96.3
Latest_non_vulnerable_version43.102.11
Affected_by_vulnerabilities
0
url VCID-2f7m-xufh-rybj
vulnerability_id VCID-2f7m-xufh-rybj
summary 
Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`
Renovate can be tricked into executing shell code while updating the Gradle Wrapper. A malicious `distributionUrl` in `gradle/wrapper/gradle-wrapper.properties` can lead to command execution in the Renovate runtime.
references
0
reference_url https://github.com/renovatebot/renovate
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/renovatebot/renovate
1
reference_url https://github.com/renovatebot/renovate/releases/tag/42.68.5
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/renovatebot/renovate/releases/tag/42.68.5
2
reference_url https://github.com/advisories/GHSA-pfq2-hh62-7m96
reference_id GHSA-pfq2-hh62-7m96
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-pfq2-hh62-7m96
3
reference_url https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96
reference_id GHSA-pfq2-hh62-7m96
reference_type
scores
0
value 6.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96
fixed_packages
0
url pkg:npm/renovate@42.68.5
purl pkg:npm/renovate@42.68.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-thg8-1rbz-xbf5
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/renovate@42.68.5
aliases GHSA-pfq2-hh62-7m96
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-2f7m-xufh-rybj
Fixing_vulnerabilities
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:npm/renovate@42.40.2