Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXdqcjQtMmpndy1obXY4

Command Injection in whereis

Versions of whereis before 0.4.1 are vulnerable to command injection if untrusted user input is passed into whereis.

Recommendation

Update to version 0.4.1 or later.

Permalink: https://github.com/advisories/GHSA-wjr4-2jgw-hmv8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXdqcjQtMmpndy1obXY4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 5 years ago
Updated: 8 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-wjr4-2jgw-hmv8, CVE-2018-3772
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-3772
• https://github.com/vvo/node-whereis/commit/0f64e3780235004fb6e43bfd153ea3e0e210ee2b
• https://hackerone.com/reports/319476
• https://github.com/advisories/GHSA-wjr4-2jgw-hmv8
• https://www.npmjs.com/advisories/604

Repository: https://github.com/vvo/node-whereis
Blast Radius: 21.0

Affected Packages