GitHub Advisoryadvisory · npm

GHSA-rwvf-c3wm-qm6w ffmpeg-sdk vulnerable to OS Command Injection

CRITICAL Published 2022-07-26 Modified 2022-08-06 Official page ↗

Aliases: CVE-2020-28435
Ecosystem: npm
Packages: ffmpeg-sdk
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-77, CWE-78
Reviewed: 2022-08-06

Affected packages

• npm ffmpeg-sdk: <= 0.0.5 (no fix yet)

Description

A command injection vulnerability affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.

Related

Alias · CVE (1)

CVE-2020-28435 This affects all versions of package ffmpeg-sdk. vulnerability

Weakness · CWE (2)

CWE-77 Improper Neutralization of Special Elements used in a Command weakness
CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References