[GHSA-6m8p-4fxj-pgc2] OS Command Injection in mversion

[nikpivkin]

Updates

• Affected products
• Severity

Comments
The range should end at < 2.0.1, not <= 1.13.0. Version 2.0.0 came out before the fix.

The fix mikaelbr/mversion@b7a8b32 is in tag v2.0.1 and not in tag v2.0.0.

So version 2.0.0 is still vulnerable but is outside the current range.

[Copilot]

Copilot review overview

🟢 Approval recommended

The fix commit is included in v2.0.1 but absent from v2.0.0, and the severity matches the CVSS vector.

Review effort: Balanced
Findings: None

What changed in this PR

Corrects the mversion advisory to reflect that versions before 2.0.1 are vulnerable.

Changes:

• Removes the conflicting affected-version metadata.
• Raises severity from moderate to high.
• Updates the modification timestamp.

File	Description
GHSA-6m8p-4fxj-pgc2.json	Aligns affected versions and severity with the verified fix.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[nikpivkin]

The severity change from MODERATE to HIGH is not something I edited. The CVSS vector is unchanged, and CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8, which is HIGH. The form recomputed the severity from the vector. The only change I meant is the range.