CVE-2021-23352

creationtimestamp| type| source ---|---|--- 2021-03-09 22:52:07+00:00| seen| https://t.me/cibsecurity/24656 2021-03-12 23:01:49+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-753c-phhg-cj29...

@acala-network/bodhi (>=0.1.1, <=0.2.2-24), @acala-network/e2e (>=0.1.10, <=0.1.16) +108 more potentially affected by CVE-2021-23352 via madge (>=0.1.4, <=3.12.0)

madge NPM version =0.1.4, =0.1.1, =0.1.10, =0.6.2, =1.0.1, =0.0.12, =0.32.16, =1.0.0, =0.7.12-alpha-4eeb568.1, =0.7.12-alpha-4eeb568.1, =0.0.0, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2021-23352 Source advisory: MEND:CVE-2021-23352...

CVE-2021-23352 Command Injection

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image, .svg or .dot functions are called, is executed by the childprocess.exec function...