GHSA-f8fh-8rgm-227hCriticalCVSS 9.8

OS Command Injection in node-prompt-here

Published
May 7, 2021
Last Modified
September 13, 2023

🔗 CVE IDs covered (1)

CVE-2020-7602 →

📋 Description

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The runCommand() is called by getDevices() function in file linux/manager.js, which is required by the index. process.env.NM_CLI in the file linux/manager.js. This function is used to construct the argument of function execSync(), which can be controlled by users without any sanitization.

🎯 Affected products1

  • npm/node-prompt-here:<= 1.0.1

🔗 References (3)