The HashBrown CMS through version 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. This vulnerability allows a user with the ability to configure a project's Git deployer settings to execute arbitrary shell commands. The vulnerability is caused by the insecure interpolation of the branch value into a shell command without proper escaping in the GitDeployer.pullR [truncated]
The HashBrown CMS through 1.4.6 is affected by an OS Command Injection vulnerability (CWE-78) in its media upload thumbnail generation routine. This vulnerability allows an authenticated user with media resource scope to achieve arbitrary OS command execution in the context of the Node.js process via POST /api/{project}/{environment}/media/new. The vulnerability exists due to the Media.generateThumbnail() [truncated]
