CVE-2023-26143

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-88

Affected software

No affected versions have been published.

Timeline

Published
Sep 19, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-261445.3Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OvCVE-2023-261458.1This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.CVE-2023-261466.1All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a maliciCVE-2023-261476.1All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers valueCVE-2023-261485.3All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attaCVE-2023-261496.1Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, viaCVE-2023-26155.4Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-261507.5Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space witCVE-2023-261517.5Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet anCVE-2023-261527.5All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath CVE-2023-261539.8Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_CVE-2023-261545.9Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; al
CVE-2023-26143: Critical severity, CVSS 9.1 | Vulnix