GitHub Advisoryadvisory · npm

GHSA-8c3f-x5f9-6h62 Command injection in @diez/generation

LOW Published 2021-09-02 Modified 2021-08-26 Official page ↗
Aliases
CVE-2021-32830
Ecosystem
npm
Packages
@diez/generation
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-77, CWE-78
Reviewed
2021-08-19

Affected packages

• npm @diez/generation: <= 10.6.0 (no fix yet)

Description

The `@diez/generation` npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. Clients of the @diez/generation library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. All versions of this package are vulnerable as of the writing of this CVE.

Related

Alias · CVE (1)

  • CVE-2021-32830 The @diez/generation npm package is a client for Diez. vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References