CVE-2020-28437 Command Injection

This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...

CVE-2020-28437

CVE-2020-28437 affects all versions of the npm package heroku-env. The vulnerability is a command-injection flaw in the get() function, with the injection point in lib/get.js which is required by index.js. This allows unsanitized user input to lead to shell execution. Public sources (Veracode, GH...

get-npm-package-version 命令注入漏洞

get-npm-package-version is a package for hoperyy individual developers. It is used to get the npm package version. A command injection vulnerability exists in get-npm-package-version before 1.0.7, which is caused by command injection via the main function in index.js...

Command Injection

xopen is vulnerable to command injection. The vulnerability exists in xopenfilepath function in index.js because the command execution implementation is not properly handled which allows an attacker to inject and execute malicious commands...

Directory Traversal

snyk-broker is vulnerable to directory traversal. The vulnerability exists in exports function in index.js when reading configs which allows an attacker to traverse through the directories to read and write on files...

Command Injection

npm-help is vulnerable to command injection. The vulnerability exists in the export.latestVersion function in index.js which allows an attacker to inject and execute malicious commands...

Command Injection

git-archive is vulnerable to command injection. A local authenticated attacker is able to inject and execute malicious commands through the exports function in index.js...

GHSA-RWVF-C3WM-QM6W ffmpeg-sdk vulnerable to OS Command Injection

A command injection vulnerability affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js...

ffmpeg-sdk vulnerable to OS Command Injection

A command injection vulnerability affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js...

node-import `params` argument can be controlled by users without any sanitization

This affects all versions of package node-import. The params argument of module function can be controlled by users without any sanitization. This is then provided to the “eval” function located in line 79 in the index file index.js...

xopen is vulnerable to OS Command Injection in Exported Function xopen(filepath)

A command injection vulnerability affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopenfilepath...

GHSA-74WF-CWJG-9CF2 xopen is vulnerable to OS Command Injection in Exported Function xopen(filepath)

A command injection vulnerability affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopenfilepath...

Design/Logic Flaw

This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopenfilepath...

CVE-2020-28447

The CVE-2020-28447 entry corresponds to a command-injection vulnerability in the xopen npm package. Affected software: all versions of xopen. Root cause: in xopen(filepath) located in index.js, the code executes OS commands without proper sanitization (injection point at line 14). Impact: enables...

CVE-2020-28447 Command Injection

This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopenfilepath...

CVE-2020-28435 Command Injection

This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js...

CVE-2020-28445

CVE-2020-28445 affects the npm-help package. The vulnerability is in the function export.latestVersion() in index.js (line 13), enabling command injection . Multiple sources describe a global impact across all versions and highlight that an attacker can inject and execute commands (as shown in th...

npm-help 命令注入漏洞

npm-help is a package from the Chinese playman.me individual developer. A security vulnerability exists in npm-help, which is caused by a command injection attack in the export.latestVersion function in the index.js file...

xopen 命令注入漏洞

xopen is a package from Andrew Imm, a personal developer. It provides a very simple Promise API for opening files from Node on Windows, macOS and Linux. A security vulnerability exists in xopen that stems from a command injection attack injection point in the xopenfilepath function in the index.j...

PT-2022-8897 · Npm · Npm-Help

Name of the Vulnerable Software and Affected Versions: npm-help affected versions not specified Description: The issue affects the npm-help package, with the injection point located in line 13 of the index.js file, specifically in the export.latestVersion function. Recommendations: At the moment,...