PT-2020-19664

Name of the Vulnerable Software and Affected Versions node-key-sender versions 1.0.11 and earlier Description The issue allows execution of arbitrary commands via the arrParams argument in the execute function. This enables command injection attacks. Recommendations For node-key-sender versions...

@bionicmetrics/bionic (>=1.2.0, <=1.3.6), @emonxdefine/oindot (>=1.0.3, <=1.0.7) +9 more potentially affected by CVE-2020-7627 via node-key-sender (>=1.0.9, <=1.0.11)

node-key-sender NPM version =1.0.9, =1.2.0, =1.0.3, =1.0.9, =1.5.0, =0.0.1, =1.0.0, =1.0.5, =0.9.0, =1.2.1, =1.1.0, =2.2.0 Source cves: CVE-2020-7627 Source advisory: SNYK:JS-NODEKEYSENDER-564261...

CVE-2020-7627: Improper Neutralization of Special Elements used in an OS Command

node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute' function...

Command Injection

Overview node-key-sender is a module that send keyboard events to the operational system. Affected versions of this package are vulnerable to Command Injection. The argument arrParams in function execute can be controlled by users without any sanitization. PoC var root = require"node-key-sender";...