Command Injection

Overview curling is a node wrapper for curl with a very simple api. Affected versions of this package are vulnerable to Command Injection via the runcommand,cb function. The command argument can be controlled by users without any sanitization. PoC by JHU System Security Lab js var root =...