What is GHSA-9px9-f7jw-fwhj?

GHSA-9px9-f7jw-fwhj is a security advisory published by GitHub Security Advisories with Critical severity. Command Injection in priest-runner

Why does GHSA-9px9-f7jw-fwhj have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-9px9-f7jw-fwhj?

GHSA-9px9-f7jw-fwhj affects 1 product, including: npm/priest-runner:\u003e= 0.0.0.

GHSA-9px9-f7jw-fwhjCriticalDisclosed before NVD

Command Injection in priest-runner

Vendor

GitHub Security Advisories

Published

September 3, 2020

Last Modified

January 9, 2023

📋 Description

All versions of priest-runner are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to a spawn call, which may allow attackers to execute arbitrary code in the system. The PriestController.prototype.createChild function is vulnerable since the spawn parameters come from a POST request body.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

🎯 Affected products1

npm/priest-runner:>= 0.0.0

🔗 References (2)

https://www.npmjs.com/advisories/1492
https://github.com/advisories/GHSA-9px9-f7jw-fwhj