Lucene search

K
osvGoogleOSV:GHSA-63M4-FHF2-CMF7
HistorySep 01, 2020 - 4:43 p.m.

Command Execution in windows-cpu

2020-09-0116:43:55
Google
osv.dev
7

0.003 Low

EPSS

Percentile

68.1%

Version of windows-cpu before 0.1.5 will execute arbitrary code passed into the first argument of the findLoad method, resulting in remote code execution.

Proof of Concept

var win = require('windows-cpu');
wind.findLoad('foo & calc.exe');

Recommendation

Update to version 0.1.5 or later.

CPENameOperatorVersion
windows-cpult0.1.5

0.003 Low

EPSS

Percentile

68.1%

Related for OSV:GHSA-63M4-FHF2-CMF7