GitHub Advisoryadvisory · npm

GHSA-cr6m-62pq-hmqh OS Command injection in npm-lockfile

CRITICAL Published 2022-03-04 Modified 2022-04-04 Official page ↗
Aliases
CVE-2022-0841
Ecosystem
npm
Packages
npm-lockfile
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2022-03-04

Affected packages

• npm npm-lockfile: >= 2.0.3, < 2.0.5 → fixed in 2.0.5

Description

npm-lockfile safely generates an npm lockfile and output it to the filename of your choice. npm-lockfile before 2.0.4 does not santize unsafe external input and invoke sensitive command execution API with the input, causing command injection vulnerability. A fix was released in version 2.0.5.

Related

Alias · CVE (1)

  • CVE-2022-0841 OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References