~ / search / GHSA-cqr2-xhg6-p268

GHSA-cqr2-xhg6-p268

OS Command Injection in node-mpv

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-7632

Packages

EcosystemPackageAffectedFixed in
npm node-mpv <= 1.4.3 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.

References

External links from the advisory. They lead to third-party sites.