GHSA-63m4-fhf2-cmf7

Suggest an improvement
Source
https://github.com/advisories/GHSA-63m4-fhf2-cmf7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-63m4-fhf2-cmf7/GHSA-63m4-fhf2-cmf7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-63m4-fhf2-cmf7
Aliases
Published
2020-09-01T16:43:55Z
Modified
2023-11-08T03:58:44.351096Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Command Execution in windows-cpu
Details

Version of windows-cpu before 0.1.5 will execute arbitrary code passed into the first argument of the findLoad method, resulting in remote code execution.

Proof of Concept

var win = require('windows-cpu');
wind.findLoad('foo & calc.exe');

Recommendation

Update to version 0.1.5 or later.

References

Affected packages

npm / windows-cpu

Package

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.1.5