Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXdoNjktd2M2cS03ODg4

Command injection in node-dns-sync

dns-sync through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

Permalink: https://github.com/advisories/GHSA-wh69-wc6q-7888
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXdoNjktd2M2cS03ODg4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 4 years ago
Updated: about 2 years ago

CVSS Score: 8.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

EPSS Percentage: 0.00922
EPSS Percentile: 0.82703

Identifiers: GHSA-wh69-wc6q-7888, CVE-2020-11079
References:

• https://github.com/skoranga/node-dns-sync/security/advisories/GHSA-wh69-wc6q-7888
• https://github.com/skoranga/node-dns-sync/commit/cb10a5ac7913eacc031ade7d91596277f31645dc
• https://nvd.nist.gov/vuln/detail/CVE-2020-11079
• https://github.com/advisories/GHSA-wh69-wc6q-7888

Repository: https://github.com/skoranga/node-dns-sync
Blast Radius: 17.9

Affected Packages