GitHub Advisoryadvisory · npm

GHSA-whq6-mj2r-mjqc OS Command Injection in lsof

HIGH Published 2021-04-13 Modified 2021-03-29 Official page ↗
Aliases
CVE-2019-10783
Ecosystem
npm
Packages
lsof
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2021-03-29

Affected packages

• npm lsof: <= 0.0.4 (no fix yet)

Description

All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input.

Related

Alias · CVE (1)

  • CVE-2019-10783 All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References