GHSA-6722-xvq8-3254

SketchSVG Arbitrary Code Injection vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-26107

Packages

Ecosystem	Package	Affected	Fixed in
npm	sketchsvg	<= 0.0.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking `shell.exec` without sanitization nor parametrization while concatenating the current directory as part of the command string.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-26107 advisory
https://github.com/eBay/SketchSVG package
https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js#23L115 web
https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js#23L64 web
https://security.snyk.io/vuln/SNYK-JS-SKETCHSVG-3167969 web