Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
Related vulnerabilities
BREW-AWS-SAM-CLI-CVE-202… (GHSA-F4Q6-9QM4-H8J4)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:37 – Updated: 2026-09-10 18:54 – Source website
VLAI
Summary
OS Command Injection in cookiecutter
Details
The package cookiecutter before 2.1.1 is vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Severity
8.1 (High)
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "cookiecutter",
"resource_purl": "pkg:pypi/cookiecutter@2.7.1",
"upstream_fixed_in": "2.1.1"
},
"package": {
"ecosystem": "Homebrew",
"name": "aws-sam-cli",
"purl": "pkg:brew/aws-sam-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.165.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/cookiecutter@2.7.1",
"name": "cookiecutter",
"resource": "cookiecutter",
"strategy": "registry",
"subject_version": "2.7.1"
}
]
},
"details": "The package cookiecutter before 2.1.1 is vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.",
"id": "BREW-aws-sam-cli-CVE-2022-24065",
"modified": "2026-09-10T18:54:05Z",
"published": "2026-08-13T16:37:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24065"
},
{
"type": "WEB",
"url": "https://github.com/cookiecutter/cookiecutter/commit/fdffddb31fd2b46344dfa317531ff155e7999f77"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-f4q6-9qm4-h8j4"
},
{
"type": "PACKAGE",
"url": "https://github.com/cookiecutter/cookiecutter"
},
{
"type": "WEB",
"url": "https://github.com/cookiecutter/cookiecutter/releases/tag/2.1.1"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/cookiecutter/PYSEC-2022-204.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G5TXC4JYTNGOUFMCXPZ6QKWEZN3URTAK"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQKWT7SGFDCUPPLDIELTN7FVTHWDL5YK"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-COOKIECUTTER-2414281"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OS Command Injection in cookiecutter",
"upstream": [
"GHSA-f4q6-9qm4-h8j4",
"CVE-2022-24065",
"PYSEC-2022-204",
"SNYK-PYTHON-COOKIECUTTER-2414281"
]
}
BREW-COOKIECUTTER-CVE-20… (CVE-2022-24065)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:41 – Updated: 2026-09-09 23:48 – Source website
VLAI
Summary
Command Injection
Details
The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Severity
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"upstream_fixed_in": "2.1.1"
},
"package": {
"ecosystem": "Homebrew",
"name": "cookiecutter",
"purl": "pkg:brew/cookiecutter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.1_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "git",
"upstream_evidence": [
{
"ecosystem": "GIT",
"key": "https://github.com/cookiecutter/cookiecutter",
"name": "https://github.com/cookiecutter/cookiecutter",
"strategy": "git",
"subject_version": "2.7.1"
},
{
"ecosystem": "PyPI",
"key": "pkg:pypi/cookiecutter@2.7.1",
"name": "cookiecutter",
"strategy": "registry",
"subject_version": "2.7.1"
},
{
"ecosystem": "Debian",
"key": "Debian/cookiecutter",
"name": "cookiecutter",
"strategy": "distro"
},
{
"ecosystem": "GIT",
"key": "upstream:https://github.com/cookiecutter/cookiecutter",
"name": "https://github.com/cookiecutter/cookiecutter",
"strategy": "distro",
"subject_version": "2.7.1"
},
{
"ecosystem": "PyPI",
"key": "upstream:pkg:pypi/cookiecutter@2.7.1",
"name": "cookiecutter",
"strategy": "distro",
"subject_version": "2.7.1"
},
{
"ecosystem": "Ubuntu",
"key": "Ubuntu/cookiecutter",
"name": "cookiecutter",
"strategy": "distro"
}
]
},
"details": "The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.",
"id": "BREW-cookiecutter-CVE-2022-24065",
"modified": "2026-09-09T23:48:44Z",
"published": "2026-08-13T16:41:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cookiecutter/cookiecutter/releases/tag/2.1.1"
},
{
"type": "ADVISORY",
"url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24065.json"
},
{
"type": "ADVISORY",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G5TXC4JYTNGOUFMCXPZ6QKWEZN3URTAK/"
},
{
"type": "ADVISORY",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQKWT7SGFDCUPPLDIELTN7FVTHWDL5YK/"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24065"
},
{
"type": "ADVISORY",
"url": "https://snyk.io/vuln/SNYK-PYTHON-COOKIECUTTER-2414281"
},
{
"type": "FIX",
"url": "https://github.com/cookiecutter/cookiecutter/commit/fdffddb31fd2b46344dfa317531ff155e7999f77"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"type": "CVSS_V3"
}
],
"summary": "Command Injection",
"upstream": [
"CVE-2022-24065",
"GHSA-f4q6-9qm4-h8j4",
"PYSEC-2022-204",
"SNYK-PYTHON-COOKIECUTTER-2414281"
]
}
BREW-CRUFT-CVE-2022-24065 (GHSA-F4Q6-9QM4-H8J4)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:41 – Updated: 2026-09-17 19:38 – Source website
VLAI
Summary
OS Command Injection in cookiecutter
Details
The package cookiecutter before 2.1.1 is vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Severity
8.1 (High)
References
| URL | Type | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "cookiecutter",
"resource_purl": "pkg:pypi/cookiecutter@2.7.1",
"upstream_fixed_in": "2.1.1"
},
"package": {
"ecosystem": "Homebrew",
"name": "cruft",
"purl": "pkg:brew/cruft"
},
"ranges": [
{
"events": [
{
"introduced": "2.9.0"
},
{
"fixed": "2.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/cookiecutter@2.7.1",
"name": "cookiecutter",
"resource": "cookiecutter",
"strategy": "registry",
"subject_version": "2.7.1"
}
]
},
"details": "The package cookiecutter before 2.1.1 is vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.",
"id": "BREW-cruft-CVE-2022-24065",
"modified": "2026-09-17T19:38:44Z",
"published": "2026-08-13T16:41:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24065"
},
{
"type": "WEB",
"url": "https://github.com/cookiecutter/cookiecutter/commit/fdffddb31fd2b46344dfa317531ff155e7999f77"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-f4q6-9qm4-h8j4"
},
{
"type": "PACKAGE",
"url": "https://github.com/cookiecutter/cookiecutter"
},
{
"type": "WEB",
"url": "https://github.com/cookiecutter/cookiecutter/releases/tag/2.1.1"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/cookiecutter/PYSEC-2022-204.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G5TXC4JYTNGOUFMCXPZ6QKWEZN3URTAK"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQKWT7SGFDCUPPLDIELTN7FVTHWDL5YK"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-COOKIECUTTER-2414281"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OS Command Injection in cookiecutter",
"upstream": [
"GHSA-f4q6-9qm4-h8j4",
"CVE-2022-24065",
"PYSEC-2022-204",
"SNYK-PYTHON-COOKIECUTTER-2414281"
]
}
PYSEC-2022-204
Vulnerability from pysec - Published: 2022-06-08 08:15 - Updated: 2022-06-08 10:35
VLAI
Details
The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Impacted products
| Name | purl | cookiecutter | pkg:pypi/cookiecutter |
|---|
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "cookiecutter",
"purl": "pkg:pypi/cookiecutter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "fdffddb31fd2b46344dfa317531ff155e7999f77"
}
],
"repo": "https://github.com/cookiecutter/cookiecutter",
"type": "GIT"
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1",
"0.2",
"0.2.1",
"0.3",
"0.4",
"0.5",
"0.6.0",
"0.6.1",
"0.6.2",
"0.6.3",
"0.6.4",
"0.7.0",
"0.7.1",
"0.7.2",
"0.8.0",
"0.9.0",
"0.9.1",
"1.0.0",
"1.1.0",
"1.2.0",
"1.2.1",
"1.3.0",
"1.4.0",
"1.5.0",
"1.5.1",
"1.6.0",
"1.7.0",
"1.7.1",
"1.7.2",
"1.7.3",
"2.1.0"
]
}
],
"aliases": [
"CVE-2022-24065",
"SNYK-PYTHON-COOKIECUTTER-2414281",
"GHSA-f4q6-9qm4-h8j4"
],
"details": "The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.",
"id": "PYSEC-2022-204",
"modified": "2022-06-08T10:35:31.256727Z",
"published": "2022-06-08T08:15:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://snyk.io/vuln/SNYK-PYTHON-COOKIECUTTER-2414281"
},
{
"type": "FIX",
"url": "https://github.com/cookiecutter/cookiecutter/commit/fdffddb31fd2b46344dfa317531ff155e7999f77"
},
{
"type": "WEB",
"url": "https://github.com/cookiecutter/cookiecutter/releases/tag/2.1.1"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-f4q6-9qm4-h8j4"
}
]
}