OS Command Injection

2022-06-0306:08:31

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

os command injection

lifion-verify-deps

index.js

getlatestversions

getlatesttag

software

package.json

EPSS

0.003

Percentile

68.2%

JSON

lifion-verify-deps is vulnerable to OS command injection. An attacker can inject and execute malicious commands through the getLatestVersions and getLatestTag functions of index.js by providing a maliciously crafted dependency name to the package.json