GHSA-4xrw-wvmq-8jmh
OS Command Injection in node-key-sender
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | node-key-sender | <= 1.0.11 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute()' function.
References
External links from the advisory. They lead to third-party sites.