Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HErlang Rebar3
APPErlang3.0.03.1.0 – 3.13.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
Related vulnerabilities
CVE-2019-1000014HIGH8.8ten sam produkt
Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry veri...
CVE-2026-21619LOW2.0ten sam produkt
Podatność Uncontrolled Resource Consumption oraz Deserialization of Untrusted Data w modułach hex_api bibliote...
CVE-2025-32433CRITICAL10.0⚠ KEVPL ✓ten sam vendor
Erlang/OTP SSH — nieuwierzytelniony RCE (CVSS 10.0)
CVE-2022-37026CRITICAL9.8ten sam vendor
In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication...
CVE-2016-10253CRITICAL9.8ten sam vendor
An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable ...