Description (CNA)
unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this vulnerability using a crafted archive name, password, or video name. This vulnerability is fixed in 7.0.3a.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| EDM115 / unzip-bot | affected < 7.0.3a |
CWE
CWE-78
References
- https://github.com/EDM115/unzip-bot/security/advisories/GHSA-34cg-7f8c-fm5h
- https://github.com/EDM115/unzip-bot/commit/5213b693eabb562842cdbf21c1074e91bfa00274
ADP enrichment
No English description supplied.
No references supplied.