GitHub Advisoryadvisory · npm

GHSA-9jm3-5835-537m Command Injection in apex-publish-static-files

CRITICAL Published 2018-11-01 Modified 2023-09-13 Official page ↗
Aliases
CVE-2018-16462
Ecosystem
npm
Packages
apex-publish-static-files
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2020-06-16

Affected packages

• npm apex-publish-static-files: < 2.0.1 → fixed in 2.0.1

Description

Versions of `apex-publish-static-files` before 2.0.1 are vulnerable to command injection. This is exploitable if user input is passed into the `connectString` option in the `publish` method. Recommendation Update to version 2.0.1 or later.

Related

Alias · CVE (1)

  • CVE-2018-16462 A command injection vulnerability in the apex-publish-static-files npm module version <2.0.1 which allows arbitrary shell command execution… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References