Command injection

2018-05-3120:29:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

27.1%

JSON

electron-packager is a command line tool that packages Electron source code into .app and .exe packages. along with Electron. The --strict-ssl command line option in electron-packager >= 5.2.1 <= 6.0.0 || >=6.0.0 <= 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a man in the middle attack.

CPENameOperatorVersion
electron-packagerge5.2.1
electron-packagerle6.0.2

CPE	Name	Operator	Version
	electron-packager	ge	5.2.1
	electron-packager	le	6.0.2

References

github.com/electron-userland/electron-packager/issues/333

nodesecurity.io/advisories/104