Threats tagged 'ghsa-92x2-9gq9-2w2v'

NellyW8 MCP4EDA version 1.0.0 contains a command injection vulnerability in the run_openlane/view_waveform component. This issue arises from improper handling of the design_name/vcd_file argument, allowing local users with limited privileges to execute arbitrary commands. The project has been notified but has not yet issued a response or fix. The vulnerability has a CVSS score of 5.3, indicating a low severity level.