GitHub Advisoryadvisory · npm

GHSA-q5pq-pgrv-fh89 dns-sync command injection vulnerability

CRITICAL Published 2017-10-24 Modified 2023-09-05 Official page ↗
Aliases
CVE-2014-9682
Ecosystem
npm
Packages
dns-sync
Severity
Critical
Weaknesses
CWE-77
Reviewed
2020-06-16

Affected packages

• npm dns-sync: < 0.1.1 → fixed in 0.1.1

Description

The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.

Related

Alias · CVE (1)

  • CVE-2014-9682 The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References