CVE-2015-7982
Command Injection in gm
Description
Versions of `gm` prior to 1.21.1 are affected by a command injection vulnerability. The vulnerability is triggered when user input is passed into `gm.compare()`, which fails to sanitize input correctly before calling the graphics magic binary. ## Recommendation Update to version 1.21.1 or later.
How to fix CVE-2015-7982
To remediate CVE-2015-7982, upgrade the affected package to a fixed version below.
- npm/gm—upgrade to 1.21.1 or later
Is CVE-2015-7982 being exploited?
No exploitation signal available. Neither CISA KEV nor a current EPSS score has been published for CVE-2015-7982.
Affected packages (1)
- from 0, < 1.21.1