GHSA-4gp3-p7ph-x2jrCriticalCVSS 9.8

OS Command Injection in devcert-sanscache

Published
April 14, 2020
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2019-10778 →

📋 Description

devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable commonName controlled by user input is used as part of the exec function without any sanitization.

🎯 Affected products1

  • npm/devcert-sanscache:< 0.4.7

🔗 References (4)