Code injection in blamer
Priority MEDIUM 49CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker.
Why it matters now
EPSS 0.04268 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed blamer (npm): 1.0.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | blamer | Fixed Version: 1.0.1 | — | No fix listed | CNA |
| — | blamer (npm) | before 1.0.1 | 1.0.1 | Patch available | GHSA-7vm7-j8p7-h346 |
- blamer Vendor— Affected Fixed Version: 1.0.1 Fixed in — No fix listed CNA
- blamer (npm) Vendor— Affected before 1.0.1 Fixed in 1.0.1 Patch available GHSA-7vm7-j8p7-h346
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:blamer_project:blamer:*:*:*:*:*:node.js:*:* | before 1.0.1 | Vulnerable | Blamer Project |
- cpe:2.3:a:blamer_project:blamer:*:*:*:*:*:node.js:*:* Versions before 1.0.1 Vulnerable ·Blamer Project
Remediation
- Fix · GHSA-7vm7-j8p7-h346 blamer (npm) Fixed in 1.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8137
- 2026-10-03 Alias added: GHSA-7vm7-j8p7-h346
References
More Blamer Project Blamer vulnerabilities
- TI-2023-11367 Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument… CVSS 3.1CRITICAL 9.1
- TI-2019-08072 OS command injection in blamer CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-8137 · CVE Program
- CVE-2020-8137 · NVD
- FIRST EPSS
- GHSA-7vm7-j8p7-h346 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences