GitHub Advisoryadvisory · npm

GHSA-4228-7qvx-f4rq Injection and Command Injection in devcert

HIGH Published 2021-05-18 Modified 2021-05-11 Official page ↗
Aliases
CVE-2020-8186
Ecosystem
npm
Packages
devcert
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74, CWE-77, CWE-78
Reviewed
2021-05-11

Affected packages

• npm devcert: < 1.1.2 → fixed in 1.1.2

Description

A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFor` function.

Related

Alias · CVE (1)

  • CVE-2020-8186 A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input… vulnerability

Weakness · CWE (3)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References