GitHub Advisoryadvisory · npm

GHSA-4qqc-mp5f-ccv4 Command Injection in bestzip

CRITICAL Published 2020-09-02 Modified 2020-09-02 Official page ↗
Ecosystem
npm
Packages
bestzip
Severity
Critical
Weaknesses
CWE-77
Reviewed
2020-09-02

Affected packages

• npm bestzip: < 2.1.7 → fixed in 2.1.7

Description

Versions of `bestzip` prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `exec` call on the `zip` function . This may allow attackers to execute arbitrary code in the system as long as the values of `destination` is user-controlled. This only affects users with a native `zip` command available. The following examples demonstrate the issue from the CLI and also programatically: • `bestzip test.zip 'sourcefile; mkdir folder'` • `zip({ source: 'sourcefile', destination: './test.zip; mkdir folder' })`

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References