CVE-2023-26143

Summary

CVE-2023-26143 is a vulnerability affecting versions of the blamer package below 1.0.4. This issue allows for Arbitrary Argument Injection via the blameByFile() API. The library fails to sanitize user input or validate file paths, making it susceptible to malicious input. Additionally, the library does not appropriately use double-dash POSIX characters to mark the end of options when passing command-line flags to the git binary, potentially leading to further command injection. These shortcomings could result in unintended git commands being executed, posing a security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.