GHSA-4qqc-mp5f-ccv4

Suggest an improvement
Source
https://github.com/advisories/GHSA-4qqc-mp5f-ccv4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-4qqc-mp5f-ccv4/GHSA-4qqc-mp5f-ccv4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-4qqc-mp5f-ccv4
Published
2020-09-02T15:05:51Z
Modified
2020-09-02T15:04:08Z
Summary
Command Injection in bestzip
Details

Versions of bestzip prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the zip function . This may allow attackers to execute arbitrary code in the system as long as the values of destination is user-controlled. This only affects users with a native zip command available. The following examples demonstrate the issue from the CLI and also programatically: - bestzip test.zip 'sourcefile; mkdir folder' - zip({ source: 'sourcefile', destination: './test.zip; mkdir folder' })

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2020-09-02T15:04:08Z",
    "nvd_published_at": null,
    "severity": "CRITICAL",
    "cwe_ids": [
        "CWE-77"
    ]
}
References

Affected packages

npm / bestzip

Package

Name
bestzip
View open source insights on deps.dev
Purl
pkg:npm/bestzip

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.1.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-4qqc-mp5f-ccv4/GHSA-4qqc-mp5f-ccv4.json"