GHSA-cr6m-62pq-hmqhCriticalCVSS 9.8

OS Command injection in npm-lockfile

Published
March 4, 2022
Last Modified
February 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-0841 →

📋 Description

npm-lockfile safely generates an npm lockfile and output it to the filename of your choice. npm-lockfile before 2.0.4 does not santize unsafe external input and invoke sensitive command execution API with the input, causing command injection vulnerability. A fix was released in version 2.0.5.

🎯 Affected products1

  • npm/npm-lockfile:>= 2.0.3, < 2.0.5

🔗 References (4)