{"action":"Upgrade pullit to 1.4.0 or later.","affected":[{"fixed":"1.4.0","introduced":"0"}],"component":"pullit","cve_ids":["CVE-2018-25083"],"ecosystem":"npm","epss":0.02693,"exploited":false,"fixed_versions":["1.4.0"],"ghsa_id":"GHSA-8px5-63x9-5c7p","id":"tcs_01M5KFDQ7RKM3ZRMYPVFJG5K7R","modified_at":"2023-11-08T04:00:16.322767Z","published_at":"2020-09-03T16:47:30Z","references":["https://osv.dev/vulnerability/GHSA-8px5-63x9-5c7p","https://nvd.nist.gov/vuln/detail/CVE-2018-25083","https://github.com/jkup/pullit/issues/23","https://github.com/jkup/pullit/commit/4fec455774ee08f4dce0ef2ef934ffcc37219bfb","https://hackerone.com/reports/315773","https://github.com/jkup/pullit","https://security.snyk.io/vuln/npm:pullit:20180214"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-8px5-63x9-5c7p","url":"https://osv.dev/vulnerability/GHSA-8px5-63x9-5c7p"}],"summary":"pullit vulnerable to command injection"}