GitHub Advisoryadvisory · npm

GHSA-4q8f-5xxj-946r Command Injection in addax

HIGH Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
addax
Severity
High
Weaknesses
CWE-77
Reviewed
2020-08-31

Affected packages

• npm addax: < 1.1.0 → fixed in 1.1.0

Description

Versions of `addax` prior to 1.1.0 are vulnerable to Command Injection. The package does not validate user input on the `presignPath` function which receives input directly from the API endpoint. Exploiting the vulnerability requires authentication. This may allow attackers to run arbitrary commands in the system. Recommendation Upgrade to version 1.1.0 or later.

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References