{"id":"GHSA-vr9x-mm65-2438","summary":"Command Injection in jison","details":"**Withdrawn:** This vulnerability is not present in the released npm package.  Rather the vulnerable code is\npart of the repo, but not part of the package. See linked hackerone report for more details.\n\nInsufficient input validation in npm package `jison` \u003c= 0.4.18 may lead to OS command injection attacks.","aliases":["CVE-2020-8178"],"modified":"2026-09-10T03:48:59.046129268Z","published":"2020-10-08T21:38:51Z","withdrawn":"2020-10-19T18:55:38Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2020-10-08T21:36:44Z","nvd_published_at":null,"cwe_ids":["CWE-78"],"severity":"HIGH"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8178"},{"type":"WEB","url":"https://hackerone.com/reports/690010"}],"affected":[{"package":{"name":"jison","ecosystem":"npm","purl":"pkg:npm/jison"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.4.18"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/10/GHSA-vr9x-mm65-2438/GHSA-vr9x-mm65-2438.json"}}],"schema_version":"1.9.0"}