CVE-2019-10801

2020-02-2821:15:12

Google

osv.dev

7 High

AI Score

Confidence

High

0.01 Low

EPSS

Percentile

83.4%

enpeem through 2.2.0 allows execution of arbitrary commands. The “options.dir” argument is provided to the “exec” function without any sanitization.

CPENameOperatorVersion
enpeemeq0.1.0
enpeemeq1.0.0
enpeemeq2.2.0
enpeemeq2.0.1
enpeemeq0.1.1
enpeemeq2.1.0
enpeemeq2.0.0
enpeemeq0.2.0

Name	Operator	Version
enpeem	eq	0.1.0
enpeem	eq	1.0.0
enpeem	eq	2.2.0
enpeem	eq	2.0.1
enpeem	eq	0.1.1
enpeem	eq	2.1.0
enpeem	eq	2.0.0
enpeem	eq	0.2.0

References

github.com/balderdashy/enpeem/blob/master/index.js#L114

snyk.io/vuln/SNYK-JS-ENPEEM-559007