CVE-2022-25853

HIGH

semver-tags - OS Command Injection via getGitTagsRemote Function

Title source: llm

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization.

Core 2

Core References

Broken Link

Exploit, Third Party Advisory

CVSS v3 7.4

EPSS 0.0032

EPSS Percentile 54.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

CWE

CWE-78

Status published

Products (2)

npm/semver-tags 0npm

semver-tags_project/semver-tags

Published Feb 06, 2023

Tracked Since Feb 18, 2026