PT-2019-20036 · Npm · Command-Exists

Publicado 2019-06-03 · Atualizado 2019-06-03

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions command-exists versions prior to 1.2.4

Description The issue allows for command injection, which can be exploited if user input is provided to the command-exists module.

Recommendations Update to version 1.2.4 or later.

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

GHSA-CFF4-RRQ6-H78W

Produtos afetados

Command-Exists

Referências · 5

• https://github.com/mathisonian/command-exists/blob/v1.2.2/lib/command-exists.js#L49-L94 · Nota
• https://github.com/mathisonian/command-exists/commit/7ca91ba71604df6817a28c93d7776af9c49c431a · Nota
• https://hackerone.com/reports/324453 · Nota
• https://npmjs.com/advisories/659 · Nota
• https://osv.dev/vulnerability/GHSA-cff4-rrq6-h78w · Aviso do Fabricante