GHSA-mxmj-84q8-34r7

Source

https://github.com/advisories/GHSA-mxmj-84q8-34r7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-mxmj-84q8-34r7/GHSA-mxmj-84q8-34r7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mxmj-84q8-34r7

Published

2020-09-03T02:39:49Z

Modified

2020-08-31T18:41:47Z

Summary

Command Injection in expressfs

Details

All versions of expressfs are vulnerable to Command Injection. The package does not validate user input on several API endpoints, allowing attackers to run arbitrary commands in the system. The affected endpoints are: expressfs.appendFile, expressfs.cp, expressfs.create and expressfs.rmdir.

Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Database specific

{
    "cwe_ids":  [
        "CWE-77"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:41:47Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

https://www.npmjs.com/advisories/953

Affected packages

npm / expressfs

Package

Name: expressfs; View open source insights on deps.dev
Purl: pkg:npm/expressfs

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-mxmj-84q8-34r7/GHSA-mxmj-84q8-34r7.json"