CVE-2020-7634

Name of the Vulnerable Software and Affected Versions heroku-addonpool versions 0.1.15 and earlier

Description The issue concerns a Command Injection problem. Specifically, the second parameter of the exported function HerokuAddonPool(id, app, opt) can be controlled by users without any sanitization, allowing for potential command injection attacks.

Recommendations For heroku-addonpool versions 0.1.15 and earlier, consider disabling the HerokuAddonPool function until a patch is available to prevent command injection attacks. Restrict access to the HerokuAddonPool function to minimize the risk of exploitation. Avoid using the app parameter in the HerokuAddonPool function without proper sanitization until the issue is resolved.