GitHub Advisoryadvisory · npm

GHSA-f2jw-pr2c-9x96 Code injection in @rkesters/gnuplot

CRITICAL Published 2022-02-10 Modified 2022-05-04 Official page ↗
Aliases
CVE-2021-29369
Ecosystem
npm
Packages
@rkesters/gnuplot
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77, CWE-78
Reviewed
2021-05-19

Affected packages

• npm @rkesters/gnuplot: < 0.1.1 → fixed in 0.1.1

Description

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.

Related

Alias · CVE (1)

  • CVE-2021-29369 The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands. vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References