npm pullit vulnerabilities

Latest npm pullit CVEs

Newest publication first

1. CVE-2018-25083 pullit vulnerable to command injection

   Published 2023-03-27

   Critical·CVSS 9.8 EPSS 2.7%

   The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.