CyberRota Analysis
AI-GeneratedThe vulnerability affects the release-it conventional-changelog up to version 11.0.1, specifically in the writeChangelog function of the Changelog File Handler, where improper handling of the infile argument allows for OS command injection. This local attack vector could enable an attacker to execute arbitrary commands on the affected system. Organizations using this component should prioritize remediation to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.