GitHub Advisoryadvisory · npm

GHSA-xhjx-mfr6-9rr4 Command Injection in samsung-remote

CRITICAL Published 2020-09-01 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
samsung-remote
Severity
Critical
Weaknesses
CWE-77
Reviewed
2020-08-31

Affected packages

• npm samsung-remote: < 1.3.5 → fixed in 1.3.5

Description

Versions of `samsung-remote` before 1.3.5 are vulnerable to command injection. This vulnerability is exploitable if user input is passed into the `ip` option of the package constructor. Recommendation Update to version 1.3.5 or later.

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References