EUVD-2022-0452

Malicious code in bioql PyPI...

dir-to-iis-app (>=1.0.0, <=1.0.2), edtool (>=0.0.1, <=0.1.16) potentially affected by CVE-2021-45459 via node-windows (1.0.0-beta.1)

node-windows NPM version 1.0.0-beta.1 is affected by a known vulnerability. The following packages have a transitive dependency on node-windows and may be impacted: - dir-to-iis-app =1.0.0, =0.0.1, =0.1.16 Source cves: CVE-2021-45459 Source advisory: OSV:GHSA-53XV-C2HX-5W6Q...

dir-to-iis-app (>=1.0.0, <=1.0.2), edtool (>=0.0.1, <=0.1.16) potentially affected by CVE-2021-45459 via node-windows (1.0.0-beta.1)

node-windows NPM version 1.0.0-beta.1 is affected by a known vulnerability. The following packages have a transitive dependency on node-windows and may be impacted: - dir-to-iis-app =1.0.0, =0.0.1, =0.1.16 Source cves: CVE-2021-45459 Source advisory: GHSA-53XV-C2HX-5W6Q...

Command Injection

node-windows is vulnerable to command injection. The vulnerability exists because the PID parameter is not sanitized, which allows a remote attacker to inject arbitrary shell commands...

CVE-2021-45459

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter...

CVE-2021-45459

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter...

Command injection

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter...

CVE-2021-45459

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter...

@exeea/pm2-windows-service (>=0.2.2, <=0.2.8), @innomizetech/pm2-windows-service (>=1.0.1, <=1.1.1) +71 more potentially affected by CVE-2021-45459 via node-windows (>=0.1.7, <=1.0.0-beta.1)

node-windows NPM version =0.1.7, =0.2.2, =1.0.1, =0.3.0, =2.0.37, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.0.3, =0.1.10, =2.1.1, =1.0.0, =0.1.0, =0.1.1 and more Source cves: CVE-2021-45459 Source advisory: MEND:CVE-2021-45459...

CVE-2021-45459: Improper Neutralization of Special Elements used in a Command

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter...

Node.js command injection vulnerability

nodejs is a JavaScript runtime environment based on the ChromeV8 engine through the Chromev8 engine for the packaging and the use of event-driven and non-blocking IO applications so that the development of high-performance Javascript background applications has become possible . A command injecti...

PT-2021-24240

Name of the Vulnerable Software and Affected Versions: node-windows versions prior to 1.0.0-beta.6 Description: The issue allows command injection via the PID parameter in the lib/cmd.js file of the node-windows package for Node.js. Recommendations: For versions prior to 1.0.0-beta.6, update to...