CVE-2021-44684

Name of the Vulnerable Software and Affected Versions: naholyr github-todos version 3.1.0

Description: The issue concerns a command injection vulnerability. Specifically, the range argument for the hook subcommand is concatenated without validation and directly used by the exec function. This lack of validation allows for potential command injection attacks.

Recommendations: For naholyr github-todos version 3.1.0, consider disabling the hook subcommand until a patch is available to prevent exploitation of the command injection vulnerability. Restrict access to the exec function to minimize the risk of exploitation. Avoid using the range argument in the affected subcommand until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.