CVE-2019-15597

An RCE attack was found in node-df, allowing an attacker to inject code via unsanitized input. The issue occurs because user input is concatenated inside a command that will be executed without verification...

@colmena/api (0.1.0), @colmena/colmena-loopback (>=0.0.4, <=0.2.1) +57 more potentially affected by CVE-2019-15597 via node-df (>=0.1.1, <=0.1.4)

node-df NPM version =0.1.1, =0.0.4, =0.0.1, =1.1.0, =3.0.0-alpha.8, =3.0.0-alpha.1, =3.0.0-alpha.0, =0.1.0, =1.0.0, =1.30.0, =0.0.1, =1.0.0, =1.0.0, =1.1.3 and more Source cves: CVE-2019-15597 Source advisory: OSV:GHSA-WP7M-MRVF-599C...

CVE-2019-15597

A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input...

CVE-2019-15597

CVE-2019-15597 affects the Node.js wrapper package node-df (v0.1.4). The root cause is unsanitized user input being concatenated into a shell command that is executed, enabling an attacker to perform remote code execution (RCE). Several sources explicitly state that all versions are vulnerable du...