CVE-2023-26143 json
blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API
published 2023-09-19 3 y ago modified 2026-06-17 4 mo ago also GHSA-6f9p-g466-f8v8 , EUVD-2023-2444
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 0
- none known
Summary
Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- security.snyk.io https://security.snyk.io/vuln/SNYK-JS-BLAMER-5731318 referenced PoC, tagged "exploit" by a source, unverified
- gist.github.com https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | blamer | <1.0.4 |
1.0.4 |
Affected products
- n/a blamer
Classification
- Weakness
-
- CWE-88 Improper Neutralization of Argument Delimiters in a Command
References
-
github.com
/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3
web, patch
-
security.snyk.io
/vuln/SNYK-JS-BLAMER-5731318
web, exploit, third-party-advisory
-
gist.github.com
/lirantal/14c3686370a86461f555d3f0703e02f9
web, exploit, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-26143
advisory
-
github.com
/kucherenko/blamer
package
Sources
- CVE List CVE-2023-26143
- GitHub Advisory GHSA-6f9p-g466-f8v8
- NVD CVE-2023-26143
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.