~ / search / GHSA-5v25-xr56-phph

GHSA-5v25-xr56-phph

Clamscan vulnerable to command injection

Source: GitHub Advisory Database (reviewed) High CVE-2020-7613

Packages

EcosystemPackageAffectedFixed in
npm clamscan < 1.3.0 1.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the `_is_clamav_binary` function located within `Index.js`. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that will be chained to execute. This lowers the risk of this issue.

References

External links from the advisory. They lead to third-party sites.