Threats tagged 'ghsa-f9f4-5859-29mf'

sqls-server/sqls version 0.2.28 contains a command injection vulnerability in the config command. The vulnerability arises because the openEditor function passes the EDITOR environment variable and config file path to a shell command without proper sanitization, allowing arbitrary command execution. This issue has been fixed in a later commit.