All the vulnerabilities related to the version 0.0.4 of the package
OS Command Injection in mversion
The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.
Command injection in mversion
This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.
Patched by version 2.0.0. Previous releases are deprecated in npm.
Make sure to escape git commit messages when using the commitMessage option for the update function.
semver vulnerable to Regular Expression Denial of Service
Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Regular Expression Denial of Service in semver
Versions 4.3.1 and earlier of semver are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.
Update to version 4.3.2 or later
