CVE-2022-24065

Command Injection

The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Affected

cookiecutter

CVSS v4.0 GitHub

9.2 CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 SNYK

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

4.47% chance of exploitation in the next 30 days, 91st percentile

Published

2022-06-03

Updated

2024-09-17

Proof-of-concept exploits (1)

• https://snyk.io/vuln/SNYK-PYTHON-COOKIECUTTER-2414281

Security advisories

• cookiecutter/cookiecutter/releases/tag/2.1.1
• advisories/GHSA-f4q6-9qm4-h8j4

References

• CVE Record
• NVD entry