What is GHSA-f698-m2v9-5fh3?

GHSA-f698-m2v9-5fh3 is a security advisory published by GitHub Security Advisories with Low severity. Command Injection in opencv

Why does GHSA-f698-m2v9-5fh3 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-f698-m2v9-5fh3?

GHSA-f698-m2v9-5fh3 affects 1 product, including: npm/opencv:\u003c 6.1.0.

GHSA-f698-m2v9-5fh3LowDisclosed before NVD

Command Injection in opencv

Vendor

GitHub Security Advisories

Published

June 4, 2019

Last Modified

January 9, 2023

📋 Description

Versions of opencvprior to 6.1.0 are vulnerable to Command Injection. The utils/ script find-opencv.js does not validate user input allowing attackers to execute arbitrary commands.

Recommendation

Upgrade to version 6.1.0.

🎯 Affected products1

npm/opencv:< 6.1.0

🔗 References (3)

https://github.com/peterbraden/node-opencv/commit/81a4b8620188e89f7e4fc985f3c89b58d4bcc86b#diff-dab2f6d17b2fd005a9425e97172dc8cb
https://www.npmjs.com/advisories/789
https://github.com/advisories/GHSA-f698-m2v9-5fh3