Skip to content

Command Injection

Moderate
otakuu published GHSA-pvfr-7gf9-pmpc Feb 23, 2023

Package

pip databricks-rocket (pip)

Affected versions

<= 1.1.6

Patched versions

1.2.0

Description

Description

Unsanitized input from a command line argument flows into os.system, where it is used as a shell command. This may result in a Command Injection vulnerability.

python3 rocket_local.py _watch .; touch os_injection.txt; #

This vulnerability was fixed in version 1.2.0. Please update.

Severity

Moderate

CVE ID

No known CVE

Weaknesses

No CWEs

Credits