CVE-2023-26143

    Dashboard / Vulnerabilities / CVE-2023-26143

    CVE-2023-26143

    Published: 19 Sept 2023Last Modified: 12 Aug 2026

    Summary:

    Details: Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.

    References: https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9, https://security.snyk.io/vuln/SNYK-JS-BLAMER-5731318, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26143.json, https://nvd.nist.gov/vuln/detail/CVE-2023-26143, https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -2ca7c28bdd8d31bb7d8bd33e8a637c456476a853

    Affected versions

    v1.0.3
    v1.0.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-26143 | CVE-DB