Packages / ng-packagr / Security

ModerateVulnerabilityGHSA-qm28-7hqv-wg5jCVE-2020-7735SNYK-JS-NGPACKAGR-1012427Published 7 May 2021

OS Command Injection in ng-packagr

Affected releases · ng-packagr

  • 10.x10.0.0 – 10.1.0Fixed in 10.1.1
  • 9.x and older1.0.0 – 9.1.5No fix, no longer updated

On 10.x, the newest line:

npm install ng-packagr@10.1.1
22.x

  1. Not affected

    22.0.0 – 22.2.4

    10 releases, latest

10.x

  1. Affected

    10.0.0 – 10.1.0

    6 releases

  2. Fixed

    10.1.1 – 10.1.2

    2 releases

9.x

  1. Affected

    9.0.0 – 9.1.5

    10 releases

5.x

  1. Affected

    5.0.0 – 5.7.1

    15 releases

4.x

  1. Affected

    4.0.0 – 4.7.1

    13 releases

3.x

  1. Affected

    3.0.0 – 3.0.6

    6 releases

2.x

  1. Affected

    2.0.0 – 2.4.5

    10 releases

1.x

  1. Affected

    1.0.0 – 1.7.0

    13 releases

200 stable releases of ng-packagr, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for ng-packagr. It is read in your browser and sent nowhere.

What happens

The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.