High severity7.3NVD Advisory· Published Jun 18, 2020· Updated Jun 17, 2026
CVE-2020-4059
CVE-2020-4059
Description
In mversion before 2.0.0, there is a command injection vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This vulnerability is patched by version 2.0.0. Previous releases are deprecated in npm. As a workaround, make sure to escape git commit messages when using the commitMessage option for the update function.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mversionnpm | < 2.0.0 | 2.0.0 |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/mikaelbr/mversion/commit/6c76c9efd27c7ff5a5c6f187e8b7a435c4722338nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-qjg4-w4c6-f6c6ghsaADVISORY
- github.com/mikaelbr/mversion/security/advisories/GHSA-qjg4-w4c6-f6c6nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2020-4059ghsaADVISORY
News mentions
0No linked articles in our index yet.