Medium severity6.5NVD Advisory· Published Sep 19, 2023· Updated Jun 17, 2026
CVE-2023-26143
CVE-2023-26143
Description
Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
blamernpm | < 1.0.4 | 1.0.4 |
Affected products
2- blamer/blamerdescription
Patches
Vulnerability mechanics
References
5- github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3nvdPatchWEB
- gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9nvdExploitThird Party AdvisoryWEB
- security.snyk.io/vuln/SNYK-JS-BLAMER-5731318nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-6f9p-g466-f8v8ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-26143ghsaADVISORY
News mentions
0No linked articles in our index yet.