GitHub Advisoryadvisory · npm

GHSA-xrjf-phvv-r4vr Command injection in strapi

MEDIUM Published 2022-02-27 Modified 2022-03-09 Official page ↗
Aliases
CVE-2022-0764
Ecosystem
npm
Packages
strapi
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
Weaknesses
CWE-77, CWE-78
Reviewed
2022-03-01

Affected packages

• npm strapi: < 4.1.0 → fixed in 4.1.0

Description

When creating a strapi app using npxcreate-strapi-app, we can inject arbitrary commands through the template cli argument as per the code in this particular link, this happens due to improper sanitization of user input.

Related

Alias · CVE (1)

  • CVE-2022-0764 Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0. vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References