GitHub Advisoryadvisory · npm

GHSA-m7xq-8jp8-rj2c Command injection in npm-dependency-versions

CRITICAL Published 2022-04-13 Modified 2022-07-18 Official page ↗
Aliases
CVE-2022-29080
Ecosystem
npm
Packages
npm-dependency-versions
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2022-07-18

Affected packages

• npm npm-dependency-versions: <= 0.3.0 (no fix yet)

Description

The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value.

Related

Alias · CVE (1)

  • CVE-2022-29080 The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References