Remote Code Execution (RCE)

vboxmanage.js is vulnerable to remote code execution RCE. Inadequate escaping of dangerous characters allows an attacker to inject and execute arbitrary OS commands on the host OS via the command arguments...

Node.js third-party modules: [vboxmanage.js] Command Injection via insecure command concatenation

I would like to report a Command Injection issue in the vboxmanage.js module. It allows to execute arbitrary commands on the victim's PC. Module module name: vboxmanage.js version: 1.0.6 npm page: https://www.npmjs.com/package/vboxmanage.js Module Description A wrapper for VirtualBox CLI with...