GHSA-w725-67p7-xv22

Source

https://github.com/advisories/GHSA-w725-67p7-xv22

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-w725-67p7-xv22/GHSA-w725-67p7-xv22.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w725-67p7-xv22

Published

2020-09-03T17:05:04Z

Modified

2021-09-28T17:35:44Z

Summary

Command Injection in local-devices

Details

Versions of local-devices prior to 3.0.0 are vulnerable to Command Injection. The package does not validate input on ip addresses and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.

Recommendation

Upgrade to version 3.0.0 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-77"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:44:24Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / local-devices

Package

Name: local-devices; View open source insights on deps.dev
Purl: pkg:npm/local-devices

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-w725-67p7-xv22/GHSA-w725-67p7-xv22.json"