CVE-2023-26143

Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.

• CWE-88
• CWE-88

• https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9Exploit, Third Party Advisory
• https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3Patch
• https://security.snyk.io/vuln/SNYK-JS-BLAMER-5731318Exploit, Third Party Advisory
• https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9Exploit, Third Party Advisory
• https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3Patch
• https://security.snyk.io/vuln/SNYK-JS-BLAMER-5731318Exploit, Third Party Advisory

Published

Sep 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26138All versions of the package drogonframework/drogon are vulne…4.3
• CVE-2023-26139Versions of the package underscore-keypath from 0.0.11 are v…7.5
• CVE-2023-2614Cross-site Scripting (XSS) - DOM in GitHub repository pimcor…5.4
• CVE-2023-26140Versions of the package @excalidraw/excalidraw from 0.0.0 ar…6.1
• CVE-2023-26141Versions of the package sidekiq before 7.1.3 are vulnerable …4.9
• CVE-2023-26142All versions of the package crow are vulnerable to HTTP Resp…6.1
• CVE-2023-26144Versions of the package graphql from 16.3.0 and before 16.8.…5.3
• CVE-2023-26145This affects versions of the package pydash before 6.0.0. A …8.1
• CVE-2023-26146All versions of the package ithewei/libhv are vulnerable to …6.1
• CVE-2023-26147All versions of the package ithewei/libhv are vulnerable to …6.1
• CVE-2023-26148All versions of the package ithewei/libhv are vulnerable to …5.3
• CVE-2023-26149Versions of the package quill-mention before 4.0.0 are vulne…6.1