Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument…
Priority HIGH 78CWE-88Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-88.
Summary
Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01122 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed blamer: 1.0.4blamer (npm): 1.0.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | blamer | before 1.0.4 | 1.0.4 | Patch available | CNA |
| — | blamer (npm) | before 1.0.4 | 1.0.4 | Patch available | GHSA-6f9p-g466-f8v8 |
- blamer Vendor— Affected before 1.0.4 Fixed in 1.0.4 Patch available CNA
- blamer (npm) Vendor— Affected before 1.0.4 Fixed in 1.0.4 Patch available GHSA-6f9p-g466-f8v8
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:blamer_project:blamer:*:*:*:*:*:node.js:*:* | before 1.0.4 | Vulnerable | Blamer Project |
- cpe:2.3:a:blamer_project:blamer:*:*:*:*:*:node.js:*:* Versions before 1.0.4 Vulnerable ·Blamer Project
Remediation
- Fix · CNA blamer Fixed in 1.0.4
- Fix · GHSA-6f9p-g466-f8v8 blamer (npm) Fixed in 1.0.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-26143
- 2026-10-03 Alias added: GHSA-6f9p-g466-f8v8
References
More Blamer Project Blamer vulnerabilities
- TI-2020-06555 Code injection in blamer CVSS 3.1CRITICAL 9.8
- TI-2019-08072 OS command injection in blamer CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-26143 · CVE Program
- CVE-2023-26143 · NVD
- FIRST EPSS
- GHSA-6f9p-g466-f8v8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences