What is GHSA-mc7w-4cjf-c973?

GHSA-mc7w-4cjf-c973 is a security advisory published by GitHub Security Advisories with Critical severity. OS Command Injection in node-opencv

Which CVE IDs does GHSA-mc7w-4cjf-c973 cover?

GHSA-mc7w-4cjf-c973 covers the following CVE IDs: CVE-2019-10061. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mc7w-4cjf-c973?

GHSA-mc7w-4cjf-c973 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-mc7w-4cjf-c973?

GHSA-mc7w-4cjf-c973 affects 1 product, including: npm/opencv:\u003c 6.1.0.

GHSA-mc7w-4cjf-c973CriticalCVSS 9.8

OS Command Injection in node-opencv

Vendor

GitHub Security Advisories

Published

October 12, 2021

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2019-10061 →

📋 Description

utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.

🎯 Affected products1

npm/opencv:< 6.1.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2019-10061
https://github.com/peterbraden/node-opencv/commit/81a4b8620188e89f7e4fc985f3c89b58d4bcc86b
https://github.com/peterbraden/node-opencv/commit/aaece6921d7368577511f06c94c99dd4e9653563
https://www.npmjs.com/advisories/789
https://www.npmjs.com/package/opencv
https://github.com/advisories/GHSA-mc7w-4cjf-c973