EUVD-2022-1409

Malicious code in bioql PyPI...

OS Command Injection

npm-lockfile is vulnerable to OS command injection. An attacker is able to inject malicious OS command to invoke sensitive command execution API...

CVE-2022-0841

A flaw was found in npm-lockfile, where npm-lockfile v2 did not sanitize the only parameter before invoking sensitive command execution API with the input. This issue leads to a command injection vulnerability...

OS Command injection in npm-lockfile

npm-lockfile safely generates an npm lockfile and output it to the filename of your choice. npm-lockfile before 2.0.4 does not santize unsafe external input and invoke sensitive command execution API with the input, causing command injection vulnerability. A fix was released in version 2.0.5...

GHSA-CR6M-62PQ-HMQH OS Command injection in npm-lockfile

npm-lockfile safely generates an npm lockfile and output it to the filename of your choice. npm-lockfile before 2.0.4 does not santize unsafe external input and invoke sensitive command execution API with the input, causing command injection vulnerability. A fix was released in version 2.0.5...

CVE-2022-0841

OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4...

Command injection

OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4...

CVE-2022-0841 OS Command Injection in ljharb/npm-lockfile

OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4...

CVE-2022-0841

CVE-2022-0841 concerns OS command injection in ljharb/npm-lockfile (GitHub: npm-lockfile) for versions 2.0.3 and 2.0.4. The Red Hat entry notes a flaw where npm-lockfile v2 did not sanitize the only parameter before invoking a sensitive command execution API, enabling command injection. Other sou...

CVE-2022-0841 OS Command Injection in ljharb/npm-lockfile

OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4...

npm-lockfile 操作系统命令注入漏洞

npm-lockfile is an open source tool. It can securely generate npm lockfiles and output them to a filename of your choice. A security vulnerability exists in versions prior to npm-lockfile v2.0.5, which can be exploited by attackers to perform OS command injection...

OS Command Injection

Description npm-lockfile before 2.0.4 does not santize unsafe external input and invoke sensitive command execution API with the input, causing command injection vulnerability. Proof of Concept // npm i [email protected] const getLockfile = require'npm-lockfile/getLockfile';...