GitHub Advisoryadvisory · npm

GHSA-74wf-cwjg-9cf2 xopen is vulnerable to OS Command Injection in Exported Function xopen(filepath)

CRITICAL Published 2022-07-26 Modified 2022-08-06 Official page ↗

Aliases: CVE-2020-28447
Ecosystem: npm
Packages: xopen
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-77, CWE-78
Reviewed: 2022-08-06

Affected packages

• npm xopen: <= 1.0.0 (no fix yet)

Description

A command injection vulnerability affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function `xopen(filepath)`.

Alias · CVE (1)

CVE-2020-28447 This affects all versions of package xopen. vulnerability

Weakness · CWE (2)

CWE-77 Improper Neutralization of Special Elements used in a Command weakness
CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2020-28447 advisory
https://github.com/andrewimm/xopen package
https://github.com/andrewimm/xopen/blob/master/index.js web
https://security.snyk.io/vuln/SNYK-JS-XOPEN-1050981 web