CVE-2022-33127

2022-06-2317:15:14

Google

osv.dev

7.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.0%

JSON

The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment. This allows attackers to execute arbitrary commands via a crafted string.

CPENameOperatorVersion
diffyeq3.0.7
diffyeq2.0.4
diffyeq2.0.1
diffyeq2.0.6
diffyeq2.0.0
diffyeq2.0.7
diffyeq3.0.2
diffyeq2.0.5
diffyeq3.0.4
diffyeq3.3.0