GitHub Advisoryadvisory · npm

GHSA-m8xj-5v73-3hh8 curlrequest allows execution of arbitrary commands

CRITICAL Published 2020-05-13 Modified 2026-07-06 Official page ↗
Aliases
CVE-2020-7646
Ecosystem
npm
Packages
curlrequest
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2020-05-12

Affected packages

• npm curlrequest: <= 1.0.1 (no fix yet)

Description

curlrequest through 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands by using a semicolon char in any of the `options` values.

Related

Alias · CVE (1)

  • CVE-2020-7646 curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References