GitHub Advisoryadvisory · npm

GHSA-wgw3-gf4p-62xc Command Injection in wizard-syncronizer

MEDIUM Published 2020-09-11 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
wizard-syncronizer
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm wizard-syncronizer: >= 0.0.0 (no fix yet)

Description

All versions of `wizard-syncronizer` are vulnerable to Command Injection. The package does not validate input on the `cloneAndSync` function and concatenates it to an exec call. This can be abused through a malicious widget containing the payload in the `gitURL` value or through a MITM attack since the package does not enforce HTTPS. This may allow attackers to run arbitrary commands in the system. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References