Command Injection

Overview corenlp-js-interface is a deprecated package. Affected versions of this package are vulnerable to Command Injection via the main function. PoC var a = require"corenlp-js-interface"; a"' touch JHU '","","",""; Remediation There is no fixed version for corenlp-js-interface. Credit: JHU...

Command Injection

Overview adb-driver is a Universal Android USB Driver. Affected versions of this package are vulnerable to Command Injection. The argument command can be controlled by users without any sanitization. PoC var root = require"adb-driver"; root.execADBCommand' & touch Song'; the injection point is...

Command Injection

Overview promise-probe is a FFprobe wrapper. Affected versions of this package are vulnerable to Command Injection via the ffprobefile and createMuteOggoutputFile, options functions. file,outputFile,options can be controlled by users without any sanitization PoC by JHU System Security Lab js var...