CVE-2020-8129

An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code...

@dfeidao/server (>=4.5.201902251314, <=4.6.201910181238), @feidao-factory/server (>=5.0.201901071713, <=5.1.201902201403) +26 more potentially affected by CVE-2020-8129 via script-manager (>=0.2.0, <=0.8.6)

script-manager NPM version =0.2.0, =4.5.201902251314, =5.0.201901071713, =5.0.201812141540, =1.0.1-server20190117165116, =1.0.201901260938, =2.0.0, =1.6.2-patch.1, =1.0.0, =1.0.1, =1.0.0, =0.4.0, =1.1.1, =0.0.1, =1.0.1, =1.0.3 and more Source cves: CVE-2020-8129 Source advisory:...

CVE-2020-8129

An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code...

CVE-2020-8129

An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code...

CVE-2020-8129

Summary: CVE-2020-8129 affects the Node.js module script-manager (version 0.8.6 and earlier). The vulnerability arises from how the module loads code via dynamic require using a user-controlled path (execModulePath), which can cause arbitrary code execution on the server. Multiple sources (NVD, R...