GitHub Advisoryadvisory · npm

GHSA-vf26-7gjf-f92r OS Command Injection in rpi

MEDIUM Published 2021-04-13 Modified 2021-04-08 Official page ↗
Aliases
CVE-2019-10796
Ecosystem
npm
Packages
rpi
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2021-04-08

Affected packages

• npm rpi: <= 0.0.3 (no fix yet)

Description

rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization.

Related

Alias · CVE (1)

  • CVE-2019-10796 rpi through 0.0.3 allows execution of arbritary commands. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References