CVE-2019-10807: Blamer - Execution of Arbitrary Commands
Summary
CVE-2019-10807: Improper Neutralization of Special Elements used in an OS Command in Blamer. Affects blamer versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Blamer is an npm package used for tracking changes in a codebase and identifying the author responsible for each line of code. It provides a command-line interface (CLI) tool that takes arguments to perform its functions. However, versions prior to 1.0.1 are vulnerable to arbitrary command execution. This means that an attacker can inject malicious commands as part of the arguments provided to blamer, leading to unauthorized command execution.
Vulnerability Detail
The vulnerability in Blamer (CVE-2019-10807) arises from improper neutralization of special elements used in an OS command. By injecting arbitrary commands, an attacker can gain unauthorized access to the system and potentially execute malicious actions. This vulnerability has a CVSS score of 9.8 (Critical) and can result in complete compromise of confidentiality, integrity, and availability of the affected system.
How To Fix
Latest published version: 1.0.7 as of 23 Oct 2026
npm install blamer@1.0.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.1
This is the first release that contains the fix.
npm install blamer@1.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Blamer (CVE-2019-10807) allows for the execution of arbitrary commands, posing a significant risk to the affected systems. To mitigate this vulnerability, it is crucial to upgrade to Blamer version 1.0.1 or later. For further support and assistance with vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for blamer →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the affected system, potentially leading to unauthorized access, data breaches, or further compromise of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using package-lock.json to analyze the software without requiring access to the code or installation.
At the moment, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Blamer (1.0.1 or later) to mitigate the risk.
There are no known instances of this vulnerability being actively exploited in the wild. However, it is crucial to apply the recommended fix to prevent potential attacks.
For more information about this vulnerability, you can refer to the GitHub Security Advisory database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-8cxp-cjm8-fj36/GHSA-8cxp-cjm8-fj36.json
References
Related vulnerabilities
Recent vulnerabilities recorded for blamer.
