GitHub Advisoryadvisory · npm

GHSA-f8fh-8rgm-227h OS Command Injection in node-prompt-here

CRITICAL Published 2021-05-07 Modified 2023-09-13 Official page ↗
Aliases
CVE-2020-7602
Ecosystem
npm
Packages
node-prompt-here
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2021-05-03

Affected packages

• npm node-prompt-here: <= 1.0.1 (no fix yet)

Description

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The `runCommand()` is called by `getDevices()` function in file `linux/manager.js`, which is required by the `index. process.env.NM_CLI` in the file `linux/manager.js`. This function is used to construct the argument of function `execSync()`, which can be controlled by users without any sanitization.

Related

Alias · CVE (1)

  • CVE-2020-7602 node-prompt-here through 1.0.1 allows execution of arbitrary commands. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References