CVE-2020-7795

HIGH

get-npm-package-version <1.0.7 - Command Injection

Title source: llm

The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js.

Core 4

Core References

Exploit, Patch, Third Party Advisory x_refsource_misc

Release Notes, Third Party Advisory x_refsource_misc

Broken Link x_refsource_misc

Patch, Third Party Advisory x_refsource_misc

CVSS v3 7.3

EPSS 0.0369

EPSS Percentile 88.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-77

Status published

Products (2)

get-npm-package-version_project/get-npm-package-version < 1.0.7

npm/get-npm-package-version 0 - 1.0.7npm

Published Aug 02, 2022

Tracked Since Feb 18, 2026