CVE-2020-28443: 
JavaScript vulnerability analysis and mitigation

The vulnerability CVE-2020-28443 was discovered in the sonar-wrapper package, which is designed to wrap SonarQube Scanner as a node module. The vulnerability was disclosed on December 14, 2020, and published on January 26, 2021. This security flaw affects all versions of the sonar-wrapper package (Snyk Database).

The vulnerability is classified as a Command Injection flaw (CWE-78) located in the lib/sonarRunner.js file. It received a CVSS v3.1 base score of 9.8 (Critical), with attack vector being Network, attack complexity Low, requiring no privileges, and no user interaction. The vulnerability has an unchanged scope with High impact on Confidentiality, Integrity, and Availability (Snyk Database).

The exploitation of this vulnerability can result in total loss of confidentiality, leading to the disclosure of all resources within the impacted component to the attacker. It also causes complete loss of integrity, allowing attackers to modify protected files, and total loss of availability, enabling attackers to fully deny access to resources in the impacted component (Snyk Database).

Currently, there is no fixed version available for the sonar-wrapper package (Snyk Database).