What is GHSA-wqhw-frpx-5mmp?

GHSA-wqhw-frpx-5mmp is a security advisory published by GitHub Security Advisories with High severity. Command Injection in tomato

Why does GHSA-wqhw-frpx-5mmp have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-wqhw-frpx-5mmp?

GHSA-wqhw-frpx-5mmp affects 1 product, including: npm/tomato:\u003e= 0.

GHSA-wqhw-frpx-5mmpHighDisclosed before NVD

Command Injection in tomato

Vendor

GitHub Security Advisories

Published

September 2, 2020

Last Modified

January 9, 2023

📋 Description

All versions of tomato are vulnerable to Command Injection. The /api/exec endpoint does not validate user input allowing attackers to run arbitrary commands in the system.

Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

🎯 Affected products1

npm/tomato:>= 0

🔗 References (2)

https://www.npmjs.com/advisories/797
https://github.com/advisories/GHSA-wqhw-frpx-5mmp