Command Injection

2023-01-1703:28:56

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

command injection

global-modules-path

index.js

execsync

getpath

software

0.004 Low

EPSS

Percentile

73.8%

JSON

global-modules-path is vulnerable to Command Injection. The vulnerability exists due to the insecure usage of execSync in index.js, allowing an attacker to inject and execute malicious commands such as getPath("something & touch abc", "somethingElse & touch def").

CPENameOperatorVersion
global-modules-pathle2.3.1
global-modules-pathle2.3.1

CPE	Name	Operator	Version
	global-modules-path	le	2.3.1
	global-modules-path	le	2.3.1

References

github.com/advisories/GHSA-vvj3-85vf-fgmw

github.com/lorenzomigliorero/npm-node-utils/blob/b55dd81c597db657c9751332bb2242403fd3e26b/index.js#L186

github.com/lorenzomigliorero/npm-node-utils/blob/b55dd81c597db657c9751332bb2242403fd3e26b/index.js%23L186

github.com/rosen-vladimirov/global-modules-path/commit/edbdaff077ea0cf295b1469923c06bbccad3c180

github.com/rosen-vladimirov/global-modules-path/pull/16

github.com/rosen-vladimirov/global-modules-path/releases/tag/v3.0.0

0.004 Low

EPSS

Percentile

73.8%

JSON

Related for VERACODE:38879