PT-2020-18372 · Npm · Npm

Published 2020-03-25 · Updated 2020-04-09 · CVE-2020-5282

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nick Chan Bot versions prior to 1.0.0-beta

Description The issue allows for arbitrary shell execution due to a vulnerability in the npm command, which is part of the software package. This can compromise the bot.

Recommendations For versions prior to 1.0.0-beta, update to version 1.0.0-beta to resolve the issue. As a temporary workaround, consider restricting the use of the npm command until the update is applied.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-5282

GHSA-8XWP-R7PJ-CGW3

Affected Products

Npm

References · 5

• https://osv.dev/vulnerability/CVE-2020-5282 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5282 · Security Note
• ❌ https://github.com/Assfugil/nickchanbot/commit/d7dc87523fc8bb6babbf8d636c339193b236a3ba · Patch, Deleted
• ❌ https://github.com/Assfugil/nickchanbot/security/advisories/GHSA-8xwp-r7pj-cgw3 · Note, Deleted
• https://t.me/cvenotify/2157 · Telegram Post