What is GHSA-9wjh-jr2j-6r4x?

GHSA-9wjh-jr2j-6r4x is a security advisory published by GitHub Security Advisories with High severity. Remote Code Execution in pi_video_recording

Why does GHSA-9wjh-jr2j-6r4x have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-9wjh-jr2j-6r4x?

GHSA-9wjh-jr2j-6r4x affects 1 product, including: npm/pi_video_recording:\u003e= 0.

GHSA-9wjh-jr2j-6r4xHighDisclosed before NVD

Remote Code Execution in pi_video_recording

Vendor

GitHub Security Advisories

Published

September 2, 2020

Last Modified

January 9, 2023

📋 Description

All versions of pi_video_recording are vulnerable to Remote Code Execution. Due to insufficient input validation the server executes arbitrary code through the /api/record/start endpoint. After running the server, curl -POST -H "Content-Type: application/json" -d '{"filename": " || touch /tmp/worked;"}' http://localhost:5000/api/record/startcreates a file in the /tmp/ directory

Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

🎯 Affected products1

npm/pi_video_recording:>= 0

🔗 References (2)

https://www.npmjs.com/advisories/773
https://github.com/advisories/GHSA-9wjh-jr2j-6r4x