GHSA-wxrx-pc44-rcgc

Source

https://github.com/advisories/GHSA-wxrx-pc44-rcgc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-wxrx-pc44-rcgc/GHSA-wxrx-pc44-rcgc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wxrx-pc44-rcgc

Aliases

CVE-2023-26128

Published

2023-05-27T06:30:41Z

Modified

2025-01-14T15:52:06Z

Severity

8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

keep-module-latest vulnerable to Command Injection due to missing input sanitization

Details

All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the installModule function.

Note:

To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have the ability to run Node.js code within the target environment. This typically requires some level of access to the system or application hosting the Node.js environment.

Database specific

{
    "cwe_ids": [
        "CWE-20",
        "CWE-77",
        "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-30T20:07:35Z",
    "nvd_published_at": "2023-05-27T05:15:09Z",
    "severity": "HIGH"
}

References

Affected packages

npm / keep-module-latest

Package

Name: keep-module-latest; View open source insights on deps.dev
Purl: pkg:npm/keep-module-latest

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.0.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-wxrx-pc44-rcgc/GHSA-wxrx-pc44-rcgc.json"