GitHub Advisoryadvisory · npm

GHSA-m8r5-7wf4-63mw Nadesiko3 OS Command Injection vulnerability

CRITICAL Published 2022-12-05 Modified 2022-12-06 Official page ↗
Aliases
CVE-2022-41642
Ecosystem
npm
Packages
nadesiko3
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2022-12-06

Affected packages

• npm nadesiko3: < 3.3.69 → fixed in 3.3.69

Description

OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.68 and earlier allows a remote attacker to execute an arbitrary OS command when processing compression and decompression on the product. Release notes for versions 3.3.62 and 3.3.69 both link to patches for this particular issue. The JPCERT/CC advisory lists versions 3.3.68 and prior as vulnerable, and the most recent patch for this issue is tagged with version 3.3.69.

Related

Alias · CVE (1)

  • CVE-2022-41642 OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.61 and earlier allows a remote attacker to execute an arbitrary OS… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References