aheckmann/gm · Security
Command Injection in gm
- GHSA ID
- GHSA-pjh3-jv7w-9jpr
- CVE ID
- CVE-2015-7982
- Severity
- critical
- Published
- Updated
Description
Versions of gm prior to 1.21.1 are affected by a command injection vulnerability. The vulnerability is triggered when user input is passed into gm.compare(), which fails to sanitize input correctly before calling the graphics magic binary.
Recommendation
Update to version 1.21.1 or later.
CWEs
- CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')