CVE-2018-3772

2018-03-2800:00:00

CWE-77

hackerone

www.cve.org

9.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.2%

JSON

Concatenating unsanitized user input in the whereis npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The whereis module is deprecated and it is recommended to use the which npm module instead.

CNA Affected

[
  {
    "product": "whereis",
    "vendor": "https://github.com/vvo",
    "versions": [
      {
        "status": "affected",
        "version": ">= 0.4.1"
      }
    ]
  }
]

References

hackerone.com/reports/319476