CVE-2020-28434: 
JavaScript vulnerability analysis and mitigation

The vulnerability (CVE-2020-28434) affects all versions of the gitblame package, which is a Node.js package used to find out who modified a file using git blame functionality. The vulnerability was discovered and disclosed on January 26, 2021, by the JHU System Security Lab (Snyk).

The vulnerability is classified as a Command Injection vulnerability (CWE-78) with a critical severity rating. It received a CVSS v3.1 base score of 9.4 from Snyk and 9.8 from NVD. The injection point is specifically located in line 15 in lib/gitblame.js. The vulnerability is considered remotely exploitable, requires low attack complexity, and needs no privileges or user interaction to exploit (Snyk).

The vulnerability can result in a total loss of confidentiality and integrity, with potential partial impact on availability. An attacker can gain access to restricted information and modify protected files. The vulnerability allows attackers to execute arbitrary commands on the affected system (Snyk).

There is no fixed version available for the gitblame package. Users are advised to find alternative solutions as no official patch has been released (Snyk).