~ / search / GHSA-hmw2-mvvh-jf5j

GHSA-hmw2-mvvh-jf5j

OS Command Injection in enpeem

Source: GitHub Advisory Database (reviewed) High CVE-2019-10801

Packages

EcosystemPackageAffectedFixed in
npm enpeem <= 2.2.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

enpeem through 2.2.0 allows execution of arbitrary commands. The &quot;options.dir&quot; argument is provided to the &quot;exec&quot; function without any sanitization.

References

External links from the advisory. They lead to third-party sites.