x/vulndb: potential Go vuln in github.com/stripe/stripe-cli: CVE-2022-24753

[GoVulnBot]

In CVE-2022-24753, the reference URL github.com/stripe/stripe-cli (and possibly others) refers to something in Go.

• Commit: stripe/stripe-cli@be38da5

module: github.com/stripe/stripe-cli
package: stripe-cli
description: |+
    Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe community`, and `stripe open`. MacOS and Linux are unaffected. An attacker who successfully exploits the vulnerability can run arbitrary code in the context of the current user. The update addresses the vulnerability by throwing an error in these situations before the code can run.Users are advised to upgrade to version 1.7.13. There are no known workarounds for this issue.

cves:
  - CVE-2022-24753
links:
    commit: https://github.com/stripe/stripe-cli/commit/be38da5c0191adb77f661f769ffff2fbc7ddf6cd
    context:
      - https://github.com/stripe/stripe-cli/security/advisories/GHSA-4cx6-fj7j-pjx9

See doc/triage.md for instructions on how to triage this report.

[neild]

This is a bug in a CLI tool, not a user-imported package.

[gopherbot]

Change https://go.dev/cl/592767 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607216 mentions this issue: data/reports: unexclude 20 reports (14)