What is GHSA-vvj3-85vf-fgmw?

GHSA-vvj3-85vf-fgmw is a security advisory published by GitHub Security Advisories with Critical severity. global-modules-path Command Injection vulnerability

Which CVE IDs does GHSA-vvj3-85vf-fgmw cover?

GHSA-vvj3-85vf-fgmw covers the following CVE IDs: CVE-2022-21191. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vvj3-85vf-fgmw?

GHSA-vvj3-85vf-fgmw has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-vvj3-85vf-fgmw?

GHSA-vvj3-85vf-fgmw affects 1 product, including: npm/global-modules-path:\u003c 3.0.0.

GHSA-vvj3-85vf-fgmwCriticalCVSS 9.8

global-modules-path Command Injection vulnerability

Vendor

GitHub Security Advisories

Published

January 13, 2023

Last Modified

April 4, 2025

🔗 CVE IDs covered (1)

CVE-2022-21191 →

📋 Description

Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.

🎯 Affected products1

npm/global-modules-path:< 3.0.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2022-21191
https://github.com/rosen-vladimirov/global-modules-path/commit/edbdaff077ea0cf295b1469923c06bbccad3c180
https://github.com/lorenzomigliorero/npm-node-utils/blob/b55dd81c597db657c9751332bb2242403fd3e26b/index.js%23L186
https://github.com/rosen-vladimirov/global-modules-path/releases/tag/v3.0.0
https://security.snyk.io/vuln/SNYK-JS-GLOBALMODULESPATH-3167973
https://github.com/advisories/GHSA-vvj3-85vf-fgmw