CVE-2020-7634: 
JavaScript vulnerability analysis and mitigation

heroku-addonpool through version 0.1.15 is vulnerable to Command Injection. The vulnerability, identified as CVE-2020-7634, was discovered and disclosed on April 6, 2020. This security flaw affects the heroku-addonpool package, which is a tool for managing addon pools of applications in Heroku (Snyk).

The vulnerability exists in the exported function HerokuAddonPool(id, app, opt) where the second parameter 'app' can be controlled by users without proper sanitization. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical) by NVD, while Snyk rates it at 6.5 (Medium). The attack vector is network-based, requires no privileges or user interaction, and has an unchanged scope (Snyk).

If exploited, this vulnerability could lead to a total loss of confidentiality, resulting in all resources within the impacted component being exposed to the attacker. While the integrity impact is considered low, meaning modifications are possible but limited, there is no direct impact on system availability (Snyk).

The recommended mitigation is to upgrade heroku-addonpool to version 0.1.16 or higher, which contains the fix for this vulnerability (Snyk).