GHSA-63m4-fhf2-cmf7CriticalCVSS 9.8
Command Execution in windows-cpu
🔗 CVE IDs covered (1)
📋 Description
Version of windows-cpu before 0.1.5 will execute arbitrary code passed into the first argument of the findLoad method, resulting in remote code execution.
Proof of Concept
var win = require('windows-cpu');
wind.findLoad('foo & calc.exe');
Recommendation
Update to version 0.1.5 or later.
🎯 Affected products1
- npm/windows-cpu:< 0.1.5