PT-2020-9135 · Npm · Lsof

Published 2020-01-29 · Updated 2021-04-13 · CVE-2019-10783

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions lsof npm module versions 0.0.4 and earlier

Description The issue concerns Command Injection, where every exported method used by the package utilizes the exec function to parse user input, making all versions including 0.0.4 of the lsof npm module vulnerable.

Recommendations For versions 0.0.4 and earlier, consider disabling the use of the exec function to parse user input until a patch is available. Restrict access to the vulnerable methods to minimize the risk of exploitation. Avoid using the lsof npm module in sensitive operations until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-10783

GHSA-WHQ6-MJ2R-MJQC

SNYK-JS-LSOF-543632

Affected Products

Lsof

References · 5

• 🔥 https://snyk.io/vuln/SNYK-JS-LSOF-543632 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-10783 · Security Note
• https://osv.dev/vulnerability/GHSA-whq6-mj2r-mjqc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10783 · Vendor Advisory
• https://t.me/cvenotify/633 · Telegram Post