Dependabot Project Dependabot 0.119.0
Approved changes feed: RSS · Atom
cpe:2.3:a:dependabot_project:dependabot:0.119.0:-:*:*:*:*:*:*part: a version: 0.119.0 update: -
| Vendor | Dependabot Project (931d2d37-7940-5d79-8443-00e3d995211f) |
|---|---|
| Product | Dependabot (a6c8cdb7-cf39-5020-aeff-6f6adda2487e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/dependabot/dependabot-core |
purl2cpe | 2026-06-01 10:11:50.711483 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-26222 |
vulnerable | 2026-06-08 05:23:50.900508 |
Remote code execution in dependabot-core
HIGH (8.7)
Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$({curl,127.0.0.1})", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. The fix was applied to version 0.125.1. As a workaround, one can escape the branch name prior to passing it to the Dependabot::Source class.
Published: 2020-11-13T16:00:20.000Z
Updated: 2024-08-04T15:49:07.167Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.