An open API service providing security vulnerability metadata for many open source software ecosystems.
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
|
npm:windows-cpu
PURL:
pkg:npm/windows-cpu
|
< 0.1.5 | 0.1.5 | |
Affected Version RangesAll affected versions0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4 All unaffected versions0.1.5, 0.1.6, 1.0.0, 1.0.1, 1.1.0 |
|||
Version of windows-cpu before 0.1.5 will execute arbitrary code passed into the first argument of the findLoad method, resulting in remote code execution.
var win = require('windows-cpu');
wind.findLoad('foo & calc.exe');
Update to version 0.1.5 or later.
References: