CVE-2023-26129: 
JavaScript vulnerability analysis and mitigation

All versions of the package bwm-ng are vulnerable to Command Injection (CVE-2023-26129), discovered on December 20, 2022, and publicly disclosed on May 26, 2023. The vulnerability affects the Node.js package bwm-ng and stems from improper input sanitization in the 'check' function within the bwm-ng.js file (Snyk Advisory).

The vulnerability is classified as a Command Injection vulnerability (CWE-77/CWE-78) with a CVSS v3.1 base score of 7.8 (High) according to NVD, and 8.4 (High) according to Snyk. The CVSS vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access, low attack complexity, low privileges required, no user interaction needed, and high impact on confidentiality, integrity, and availability (NVD).

If successfully exploited, this vulnerability can lead to a total loss of confidentiality, integrity, and availability of the affected system. The attacker could potentially execute arbitrary commands within the context of the Node.js environment, leading to complete system compromise (Snyk Advisory).

Currently, there is no fixed version available for the bwm-ng package (Snyk Advisory).