GHSA-74wf-cwjg-9cf2

xopen is vulnerable to OS Command Injection in Exported Function xopen(filepath)

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-28447

Packages

Ecosystem	Package	Affected	Fixed in
npm	xopen	<= 1.0.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A command injection vulnerability affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function `xopen(filepath)`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-28447 advisory
https://github.com/andrewimm/xopen package
https://github.com/andrewimm/xopen/blob/master/index.js web
https://security.snyk.io/vuln/SNYK-JS-XOPEN-1050981 web