Command Injection

wc-cmd is vulnerable to command injection. An attacker is able to inject and execute malicious command via the index.js file...

CVE-2020-28429

All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require"geojson2kml"; a"./","& touch JHU",function...

Command injection

All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require"geojson2kml"; a"./","& touch JHU",function...

CVE-2020-28429 Command Injection

All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require"geojson2kml"; a"./","& touch JHU",function...

CVE-2020-28429

geojson2kml is vulnerable to Command Injection via the index.js file. Affected software: geojson2kml Node.js module. Root cause: unsafely constructs commands (PoC shows passing shell commands) leading to potential remote code execution. Impact stated in connected docs includes unauthorized access...

Insecure URL Validation

url-parse performs Insecure URL Validation. The vulnerability exists as the unsanitized value of address in index.js could be used to bypass validation checks when used in the browser...

Snyk wc-cmd Command Injection Vulnerability

Snyk wc-cmd is an application from Snyk Corporation that provides statistics on the number of bytes, words, and lines in a given file, and displays the results as output. A command injection vulnerability exists in wc-cmd, which originates from a command injection attack on the index.js file...

nuance-gulp-build-common OS Command Injection Vulnerability

nuance-gulp-build-common is a package for npm. nuance-gulp-build-common suffers from an operating system command injection vulnerability that stems from vulnerability to command injection via the index.js file...

Command Injection

async-git is vulnerable to command injection. An attacker is able to inject malicious OS command to the system shell via the getter function in the index.js file...

CVE-2020-7785

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

CVE-2020-7785 Command Injection

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

Malicious Package

jquerry is a malicious package. The index.js file downloads and executes a crypto mining script. However, the script is not executed upon installation...

Command Injection

async-git is vulnerable to command injection. An attacker is able to inject malicious OS command to the system shell via the getter function in the index.js file...

Command Injection

Overview xopen is a package that provides a dead-simple Promise API for opening files from Node on Windows, macOS, and Linux. Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 14 in index.js in the exported function xopenfilepath PoC: va...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 13 in index.js file in export.latestVersion function. PoC: var root = require"npm-help"; var module = "& touch JHU"; root.latestVersionmodule; Remediation There is no fixed versi...

Command injection in buns

There is a command injection vulnerability in all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function installrequestedModule...

Design/Logic Flaw

This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function installrequestedModule...

CVE-2020-7794

CVE-2020-7794 affects all versions of the buns package. The injection point is in lib/index.js:678 inside the exported function install(requestedModule). This enables command injection via crafted input; PoC and advisory details indicate insecure use of exec leading to arbitrary code execution. T...

CVE-2020-7794 Command Injection

This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function installrequestedModule...

Command Injection

ffmpeg-sdk is vulnerable to command injection. The vulnerability exists through the execute function in index.js, allowing an attacker to inject the code execution commands via remotely...