Cookiecutter Project Cookiecutter vulnerabilities

1 known vulnerability affecting cookiecutter_project/cookiecutter.

Total CVEs

1

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

CRITICAL1

Vulnerabilities

Page 1 of 1

CVE-2022-24065CRITICALCVSS 9.8fixed in 2.1.1≥ unspecified, < 2.1.12022-06-08

CVE-2022-24065 [CRITICAL] CWE-78 CVE-2022-24065: The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.