EUVD-2022-0564

Malicious code in bioql PyPI...

OS Command Injection in node-mpv

node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

GHSA-CQR2-XHG6-P268 OS Command Injection in node-mpv

node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

node-mpv formatting string error vulnerability

node-mpv is a Node.js based MPV player module. A security vulnerability exists in mpv version 0.33.0 and earlier versions, which can be exploited by an attacker to achieve code execution via a crafted m3u playlist file...

node-mpv 格式化字符串错误漏洞

node-mpv is a Node.js based MPV player module. A security vulnerability exists in mpv version 0.33.0 and earlier versions, which can be exploited by an attacker to achieve code execution via a crafted m3u playlist file...

Remote Code Execution (RCE)

node-mpv is vulnerable to remote code execution RCE. The vulnerability exists because the parameter options was not sanitized properly, allowing to be controlled by the attacker by sending malicious code to execute...

node-mpv command injection vulnerability

node-mpv is a wrapper to use the mpv player for node.js. A command injection vulnerability exists in node-mpv 1.4.3 and earlier. An attacker can exploit this vulnerability to execute arbitrary commands via the options parameter...

CVE-2020-7632

node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

CVE-2020-7632

node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

Command injection

node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

CVE-2020-7632

node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

Command Injection

Overview node-mpv is a wrapper to comfortably use mpv player with node.js. Affected versions of this package are vulnerable to Command Injection. The argument "options" can be controlled by users without any sanitization. PoC var Root = require"node-mpv"; var options = "binary": '" $touch JHU "'...

@beargame/devdeck (>=1.1.0 <=1.1.4), @quran-cli/q-cli (>=1.0.0 <=1.1.3) +14 more potentially affected by CVE-2020-7632 via node-mpv (>=1.5.0 <=2.0.0-beta.2)

node-mpv NPM version =1.5.0, =1.1.0, =1.0.0, =0.1.1-alpha.1, =0.1.1, =0.0.1, =3.0.0, =0.1.0, =1.0.2, =1.0.9, =0.0.4, =1.0.0, =0.1.12, =0.1.15 and more Source cves: CVE-2020-7632 Source advisory: SNYK:JS-NODEMPV-564426...