Lucene search

GitHub Advisory DatabaseGHSA-VVJ3-85VF-FGMW

HistoryJan 13, 2023 - 6:30 a.m.

global-modules-path Command Injection vulnerability

2023-01-1306:30:22

CWE-77

GitHub Advisory Database

github.com

global modules path

package

command injection

vulnerability

software

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.004 Low

EPSS

Percentile

73.8%

JSON

Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.

Affected configurations

Vulners

Node

github_advisory_databaseglobal-modules-pathRange<3.0.0

CPENameOperatorVersion
global-modules-pathlt3.0.0

CPE	Name	Operator	Version
	global-modules-path	lt	3.0.0

References

github.com/advisories/GHSA-vvj3-85vf-fgmw

github.com/lorenzomigliorero/npm-node-utils/blob/b55dd81c597db657c9751332bb2242403fd3e26b/index.js%23L186

github.com/rosen-vladimirov/global-modules-path/commit/edbdaff077ea0cf295b1469923c06bbccad3c180

github.com/rosen-vladimirov/global-modules-path/releases/tag/v3.0.0

nvd.nist.gov/vuln/detail/CVE-2022-21191

security.snyk.io/vuln/SNYK-JS-GLOBALMODULESPATH-3167973

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.004 Low

EPSS

Percentile

73.8%

JSON

Related for GHSA-VVJ3-85VF-FGMW