GitHub Advisoryadvisory · npm

GHSA-w725-67p7-xv22 Command Injection in local-devices

HIGH Published 2020-09-03 Modified 2021-09-28 Official page ↗
Ecosystem
npm
Packages
local-devices
Severity
High
Weaknesses
CWE-77
Reviewed
2020-08-31

Affected packages

• npm local-devices: < 3.0.0 → fixed in 3.0.0

Description

Versions of `local-devices` prior to 3.0.0 are vulnerable to Command Injection. The package does not validate input on ip addresses and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. Recommendation Upgrade to version 3.0.0 or later.

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References