GitHub Advisoryadvisory · npm

GHSA-4x6x-782q-jfc4 Command Injection in node-wifi

CRITICAL Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
node-wifi
Severity
Critical
Weaknesses
CWE-77
Reviewed
2020-08-31

Affected packages

• npm node-wifi: < 2.0.12 → fixed in 2.0.12

Description

Versions of `node-wifi` prior to 2.0.12 are vulnerable to Command Injection. The package fails to sanitize user input, allowing attackers to inject commands through the `ssid` variable and possibly achieving Remote Code Execution on the system. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References