Command Injection

2023-03-0407:36:35

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

command injection

vulnerability

local attackers

shell commands

environment variables

software

EPSS

Percentile

13.3%

JSON

@zowe/imperative is vulnerable to Command Injection. The vulnerability exists due to the insecure usage of execSync, which allows an already-privileged local attackers to inject and execute malicious shell commands through the plugin install/update commands or through maliciously formed environment variables.