GitHub Advisoryadvisory · npm

GHSA-pm52-wwrw-c282 Command Injection in wiki-plugin-datalog

HIGH Published 2019-06-13 Modified 2021-08-16 Official page ↗
Ecosystem
npm
Packages
wiki-plugin-datalog
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-94
Reviewed
2019-06-13

Affected packages

• npm wiki-plugin-datalog: < 0.1.6 → fixed in 0.1.6

Description

Versions of `wiki-plugin-datalog` prior to 0.1.6 are vulnerable to Command Injection. The package failed to sanitize URLs on the curl endpoint, allowing attackers to inject commands and possibly achieving Remote Code Execution on the system. Recommendation Upgrade to version 0.1.6 or later.

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References