GitHub Advisoryadvisory · npm

GHSA-xj9v-6q2f-vqhx wifey vulnerable to Command Injection due to improper input sanitization

CRITICAL Published 2023-01-09 Modified 2025-04-09 Official page ↗

Aliases: CVE-2022-25890
Ecosystem: npm
Packages: wifey
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-77, CWE-78
Reviewed: 2023-01-09

Affected packages

• npm wifey: <= 2.0.7 (no fix yet)

Description

All versions of the package wifey are vulnerable to Command Injection via the `connect()` function due to improper input sanitization.

Related

Alias · CVE (1)

CVE-2022-25890 All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization. vulnerability

Weakness · CWE (2)

CWE-77 Improper Neutralization of Special Elements used in a Command weakness
CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References