GHSA-gwp3-f7mr-qpfv

OS Command Injection in s3-uploader

Source: GitHub Advisory Database (reviewed) High CVE-2021-34084

Packages

Ecosystem	Package	Affected	Fixed in
npm	s3-uploader	<= 2.0.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metadata() function.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-34084 advisory
https://advisory.checkmarx.net/advisory/CX-2021-4776 web
https://github.com/Turistforeningen/node-s3-uploader package