Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThqNmotNGgyYy1jNjVw

Arbitrary Code Execution in require-node

Versions of require-node prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the require-node endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body.

Recommendation

If you are using 1.x, upgrade to version 1.3.4 or later.
If you are using 2.x, upgrade to version 2.0.4 or later.

Permalink: https://github.com/advisories/GHSA-8j6j-4h2c-c65p
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThqNmotNGgyYy1jNjVw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: about 4 years ago
Updated: over 1 year ago

Identifiers: GHSA-8j6j-4h2c-c65p
References:

Blast Radius: 0.0

Affected Packages

npm:require-node

Dependent packages: 3
Dependent repositories: 8
Downloads: 300 last month
Affected Version Ranges: >= 2.0.0, < 2.0.4, < 1.3.4
Fixed in: 2.0.4, 1.3.4
All affected versions: 0.0.0, 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.2.9, 1.2.10, 1.2.11, 1.2.12, 1.2.13, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 2.0.0, 2.0.1, 2.0.2, 2.0.3
All unaffected versions: 1.3.4, 1.3.5, 1.3.6, 1.3.7, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8