CVE-2023-49210

The openssl aka node-openssl NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field used for command execution. NOTE: This vulnerability only affects products that are no longer supported by t...

CVE-2023-49210

The CVE-2023-49210 entry concerns the openssl (node-openssl) NPM package up to version 2.0.0. A root cause is that the package’s opts argument contains a verb field that can be passed to exec, enabling arbitrary command execution. Multiple sources (Red Hat, Veracode, GHSA, OSV) describe this as a...