CVE-2018-25083

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Mar 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-250846.1A vulnerability, which was classified as problematic, has been found in Ping Identity Self-Service Account Manager 1.1.2. Affected by this iCVE-2018-250854.8A vulnerability classified as problematic was found in Responsive Menus 7.x-1.x-dev on Drupal. Affected by this vulnerability is the functioCVE-2018-250866.1A vulnerability was found in sea75300 FanPress CM up to 3.6.3. It has been classified as problematic. This affects the function getArticlesPCVE-2018-250877.5A vulnerability classified as problematic was found in Arborator Server. This vulnerability affects the function start of the file project.cCVE-2018-250889.8A vulnerability, which was classified as critical, was found in Blue Yonder postgraas_server up to 2.0.0b2. Affected is the function _createCVE-2018-250895.3A vulnerability was found in glb Meetup Tag Extension 0.1 on MediaWiki. It has been rated as problematic. This issue affects some unknown prCVE-2018-250905.4An unauthenticated remote attacker can use an XSS attack due to improper neutralization of input during web page generation. User interactioCVE-2018-250916.1urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs inCVE-2018-250929.8A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been declared as critical. Affected by this vulnerability is an CVE-2018-250939.8A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been rated as critical. Affected by this issue is some unknown fCVE-2018-250947.5A vulnerability was found in ระบบบัญชีออนไลน์ Online Accounting System up to 1.4.0 and classified as problematic. This issue affects some unCVE-2018-250959.8The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configur
CVE-2018-25083: Critical severity, CVSS 9.8 | Vulnix