GHSA-3q9x-w53p-jg53
OS Command Injection in heroku-addonpool
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | heroku-addonpool | < 0.1.16 | 0.1.16 |
Details
As written in the advisory (Markdown source, shown as plain text).
heroku-addonpool through 0.1.15 is vulnerable to Command Injection. The second parameter of the exported function `HerokuAddonPool(id, app, opt)` can be controlled by users without any sanitization.
**PoC**
```js
var Root = require("heroku-addonpool");
var root = Root("sss", "& touch JHU", {});
root.setup();
```
References
External links from the advisory. They lead to third-party sites.