{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-19T17:53:36.390","vulnerabilities":[{"cve":{"id":"CVE-2023-26143","sourceIdentifier":"report@snyk.io","published":"2023-09-19T05:17:10.443","lastModified":"2024-11-21T07:50:52.047","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options."},{"lang":"es","value":"Las versiones del paquete blamer anteriores a 1.0.4 son vulnerables a la inyección Arbitraria de Argumentos a través de la API blameByFile(). La librería no sanitiza la entrada del usuario ni valida que la ruta de archivo dada se ajuste a un esquema específico, ni pasa correctamente los indicadores de línea de comandos al binario git utilizando los caracteres POSIX de doble guión (--) para comunicar el final de las opciones. "}],"metrics":{"cvssMetricV31":[{"source":"report@snyk.io","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"weaknesses":[{"source":"report@snyk.io","type":"Secondary","description":[{"lang":"en","value":"CWE-88"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-88"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:blamer_project:blamer:*:*:*:*:*:node.js:*:*","versionEndExcluding":"1.0.4","matchCriteriaId":"A8E6FC04-030F-4B2D-9484-213E324BBB7A"}]}]}],"references":[{"url":"https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9","source":"report@snyk.io","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3","source":"report@snyk.io","tags":["Patch"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-BLAMER-5731318","source":"report@snyk.io","tags":["Exploit","Third Party Advisory"]},{"url":"https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-BLAMER-5731318","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}}]}