Command Injection

Overview op-browser is a module that open browser window and set proxy. Affected versions of this package are vulnerable to Command Injection. The url parameter can be controlled by users without any sanitization. PoC var root = require"op-browser"; root.open'chrome','& touch Song','',''; Details...