GitHub Advisoryadvisory · npm

GHSA-qfxv-qqvg-24pg OS Command Injection in im-metadata

HIGH Published 2021-04-13 Modified 2021-03-29 Official page ↗
Aliases
CVE-2019-10788
Ecosystem
npm
Packages
im-metadata
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2021-03-29

Affected packages

• npm im-metadata: <= 3.0.1 (no fix yet)

Description

im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of the metadata options which is given to the "exec" function.

Related

Alias · CVE (1)

  • CVE-2019-10788 im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References