CVE-2020-28436

Description

A command injection vulnerability affects all versions of the deprecated package google-cloudstorage-commands.

How to fix CVE-2020-28436

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• npm/google-cloudstorage-commands—no fix listed

Is CVE-2020-28436 being exploited?

Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, <= 0.0.1

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-28436
• PATCHgithub.com/samradical/google-cloudstorage-commands
• WEBgithub.com/samradical/google-cloudstorage-commands/blob/master/index.js%23L11
• WEBsecurity.snyk.io/vuln/SNYK-JS-GOOGLECLOUDSTORAGECOMMANDS-1050431