Node.js Operating System Command Injection Vulnerability

🗓️ 08 Jul 2022 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd🔗 www.cnnvd.org.cn👁 13 Views

Node.js OS command injection via invalid IP check enabling DNS rebinding and arbitrary code execution in Node.js versions 14, 16, and 18.

Reporter	Title	Published	Views	Family All 462
IBM Security Bulletins	Security Bulletin: IBM API Connect is impacted by a vulnerabilities in Node.js (CVE-2021-22884, CVE-2021-22883)	1 Nov 202120:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® SDK for Node.js™ in IBM Cloud	11 Mar 202117:48	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in node.js may affect configuration editor used in IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2020-1971, CVE-2020-8265, CVE-2020-8287	25 Mar 202110:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to multiple denial of service through the Node.js runtime	30 Apr 202113:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	25 Oct 202214:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in node.js	8 Aug 202217:42	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of NodeJS, IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple security vulnerabilities.	5 Sep 202311:07	–	ibm
IBM Security Bulletins	Security Bulletin: Potential vulnerability with Node.js	30 Jul 202121:10	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security contains security vulnerabilities	13 May 202121:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related Java SE and Node	22 Sep 202207:03	–	ibm

Source	Link
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
hackerone	www.hackerone.com/reports/1632921
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/VMQK5L5SBYD47QQZ67LEMHNQ662GH3OY/
debian	www.debian.org/security/2023/dsa-5326
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/2ICG6CSIB3GUWH5DUSQEVX53MOJW7LYK/
nodejs	www.nodejs.org/en/blog/vulnerability/july-2022-security-releases/
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
security	www.security.netapp.com/advisory/ntap-20220915-0001/
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
lists	www.lists.debian.org/debian-lts-announce/2022/10/msg00006.html

23 May 2026 00:00Current

8High risk

Vulners AI Score8

CVSS 3.18.1

EPSS0.36842

Node.js command injection invalid address domain name system rebinding code execution websocket debugger