GitHub Advisoryadvisory · npm

GHSA-8j6j-4h2c-c65p Arbitrary Code Execution in require-node

CRITICAL Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
require-node
Severity
Critical
Weaknesses
CWE-78
Reviewed
2020-08-31

Affected packages

• npm require-node: < 1.3.4 → fixed in 1.3.4 • npm require-node: >= 2.0.0, < 2.0.4 → fixed in 2.0.4

Description

Versions of `require-node` prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the `require-node` endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body. Recommendation • If you are using 1.x, upgrade to version 1.3.4 or later. • If you are using 2.x, upgrade to version 2.0.4 or later.

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References