[yiisoft/yii2-gii] Command injection in yiisoft/yii2-gii

Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-36655
• https://github.com/yiisoft/yii2-gii/issues/433
• https://lab.wallarm.com/yii2-gii-remote-code-execution/
• https://github.com/yiisoft/yii2-gii/commit/ed61e0d85f43e23f79d7c9d1b4e5e5c09a32ce4b
• https://github.com/advisories/GHSA-3mpg-q26j-83j5