GitHub Advisoryadvisory · npm

GHSA-gp2j-mg4w-2rh5 chrome-launcher subject to OS Command Injection

CRITICAL Published 2022-05-24 Modified 2023-09-06 Official page ↗
Aliases
CVE-2020-7645
Ecosystem
npm
Packages
chrome-launcher
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2023-02-10

Affected packages

• npm chrome-launcher: < 0.13.2 → fixed in 0.13.2

Description

chrome-launcher prior to 0.13.2 is subject to OS Command Injection via the `$HOME` environment variable in Linux operating systems. This issue is patched in version 0.13.2.

Related

Alias · CVE (1)

  • CVE-2020-7645 All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in Linux operating… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References