The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
CVE-2022-24065 - High Severity Vulnerability
Vulnerable Library - cookiecutter-1.7.3-py2.py3-none-any.whl
A command-line utility that creates projects from project templates, e.g. creating a Python package project from a Python package project template.
Library home page: https://files.pythonhosted.org/packages/a2/62/d061b19f307455506e63825586e2e1816b71d56b4a5873c278cb315b9660/cookiecutter-1.7.3-py2.py3-none-any.whl
Path to dependency file: /docs/requirements.txt
Path to vulnerable library: /docs/requirements.txt
Dependency Hierarchy: - :x: **cookiecutter-1.7.3-py2.py3-none-any.whl** (Vulnerable Library)
Found in HEAD commit: 8d0a10402c32fdfadb3cf3eed011045fb6bdc1fb
Found in base branch: master
Vulnerability Details
The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Publish Date: 2022-06-08
URL: CVE-2022-24065
CVSS 3 Score Details (9.8)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24065
Release Date: 2022-06-08
Fix Resolution: 2.1.1
Step up your Open Source Security Game with Mend here