2vulnerabilities
- Critical0 (0.0%)
- High2 (100.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
jsii-diff
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting jsii-diff, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-wcx4-wpfv-mc5c | High | jsii-diff: Command Injection via npm: package argument## Summary jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. An issue exists where specially formatted command line arguments can be used to execute shell commands via this tool. ## Impact jsii-diff supports downloading packages to compare directly from NPM, so that you can compare a proposed candidate version of your jsii package with an already-published version, by passing an argument that looks like `npm:<package-specifier>`. For example: ``` jsii-diff npm:my-package@late |
| GitHub (opens in a new tab) | |
| GHSA-h738-vh6g-q8gh | High | Duplicate Advisory: Command Injection in jsii-diff via npm: package argument### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wcx4-wpfv-mc5c. This link is maintained to preserve external references. ### Original Description OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or later. |
| GitHub (opens in a new tab) |
- GHSA-wcx4-wpfv-mc5cHighjsii-diff: Command Injection via npm: package argument
< 1.131.0
## Summary jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. An issue exists where specially formatted command line arguments can be used to execute shell commands via this tool. ## Impact jsii-diff supports downloading packages to compare directly from NPM, so that you can compare a proposed candidate version of your jsii package with an already-published version, by passing an argument that looks like `npm:<package-specifier>`. For example: ``` jsii-diff npm:my-package@late
CVE: CVE-2026-15895
- GHSA-h738-vh6g-q8ghHighDuplicate Advisory: Command Injection in jsii-diff via npm: package argument
< 1.131.0
### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wcx4-wpfv-mc5c. This link is maintained to preserve external references. ### Original Description OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or later.