GitHub Advisoryadvisory · npm

GHSA-gwp3-f7mr-qpfv OS Command Injection in s3-uploader

HIGH Published 2022-06-03 Modified 2022-06-03 Official page ↗
Aliases
CVE-2021-34084
Ecosystem
npm
Packages
s3-uploader
Severity
High
Weaknesses
CWE-78
Reviewed
2022-06-03

Affected packages

• npm s3-uploader: <= 2.0.3 (no fix yet)

Description

OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metadata() function.

Related

Alias · CVE (1)

  • CVE-2021-34084 OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References