CVE-2020-28437: 
JavaScript vulnerability analysis and mitigation

The vulnerability (CVE-2020-28437) affects all versions of the heroku-env package, which is designed to parse DATABASE_URL from Heroku config and split it into PG* environment variables used by psql, pg_dump, pg_restore, and node-postgres. The vulnerability was disclosed on January 26, 2021, and was discovered by the JHU System Security Lab (Snyk).

The vulnerability is a Command Injection flaw located in lib/get.js, which is required by index.js. The vulnerability has received a CVSS v3.1 Base Score of 9.8 (Critical), with attack vector being Network, attack complexity Low, requiring no privileges or user interaction, and having an unchanged scope. The vulnerability affects confidentiality, integrity, and availability, with High impact ratings for all three aspects (AttackerKB, Snyk).

The vulnerability can result in a total loss of confidentiality, leading to all resources within the impacted component being exposed to the attacker. There is also a complete loss of integrity, allowing the attacker to modify protected files. The availability impact is rated as high, potentially causing significant disruption to the system's resources (Snyk).

Currently, there is no fixed version available for the heroku-env package (Snyk).