node-prompt-here through 1.0.1 allows execution of arbitrary commands. The runCommand()
is called by getDevices()
function in file linux/manager.js
, which is required by the index. process.env.NM_CLI
in the file linux/manager.js
. This function is used to construct the argument of function execSync()
, which can be controlled by users without any sanitization.
CPE | Name | Operator | Version |
---|---|---|---|
node-prompt-here | le | 1.0.1 |