Command Injection

2022-06-0306:49:40

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.011 Low

EPSS

Percentile

84.5%

JSON

google-it is vulnerable to command injection. The vulnerability exists in the openInBrowser function in googleIt.js due to a lack of input sanitization which allows an attacker to inject and execute arbitrary codes.

CPENameOperatorVersion
google-itle1.6.2
google-itle1.6.2

CPE	Name	Operator	Version
	google-it	le	1.6.2
	google-it	le	1.6.2

References

advisory.checkmarx.net/advisory/CX-2021-4777

github.com/advisories/GHSA-7xhv-mpjw-422f

github.com/PatNeedham/google-it/blob/v1.6.2/lib/googleIt.js#L59

github.com/PatNeedham/google-it/blob/v1.6.2/src/googleIt.js#L34

0.011 Low

EPSS

Percentile

84.5%

JSON

Related for VERACODE:35854