GHSA-5h8c-8ccp-8gmh

mt7688-wiscan is vulnerable to Command Injection due to improper input sanitization

Source: GitHub Advisory Database (reviewed) High CVE-2022-25916

Packages

Ecosystem	Package	Affected	Fixed in
npm	mt7688-wiscan	< 0.8.3	0.8.3

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-25916 advisory
https://github.com/simenkid/mt7688-wiscan/commit/ff6d6567c65b4e972916a8fbc4533212f20a2fa5 web
https://github.com/simenkid/mt7688-wiscan package
https://github.com/simenkid/mt7688-wiscan/blob/master/index.js%23L22 web
https://security.snyk.io/vuln/SNYK-JS-MT7688WISCAN-3177394 web