GHSA-63m4-fhf2-cmf7CriticalCVSS 9.8

Command Execution in windows-cpu

Published
September 1, 2020
Last Modified
September 8, 2023

🔗 CVE IDs covered (1)

📋 Description

Version of windows-cpu before 0.1.5 will execute arbitrary code passed into the first argument of the findLoad method, resulting in remote code execution.

Proof of Concept

var win = require('windows-cpu');
wind.findLoad('foo & calc.exe');

Recommendation

Update to version 0.1.5 or later.

🎯 Affected products1

  • npm/windows-cpu:< 0.1.5

🔗 References (5)