GitHub Advisoryadvisory · npm

GHSA-wjr4-2jgw-hmv8 Command Injection in whereis

CRITICAL Published 2018-07-31 Modified 2023-09-12 Official page ↗
Aliases
CVE-2018-3772
Ecosystem
npm
Packages
whereis
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2020-06-16

Affected packages

• npm whereis: < 0.4.1 → fixed in 0.4.1

Description

Versions of `whereis` before 0.4.1 are vulnerable to command injection if untrusted user input is passed into `whereis`. Recommendation Update to version 0.4.1 or later.

Related

Alias · CVE (1)

  • CVE-2018-3772 Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References