GHSA-mc7w-4cjf-c973

OS Command Injection in node-opencv

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-10061

Packages

Ecosystem	Package	Affected	Fixed in
npm	opencv	< 6.1.0	6.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10061 advisory
https://github.com/peterbraden/node-opencv/commit/81a4b8620188e89f7e4fc985f3c89b58d4bcc86b web
https://github.com/peterbraden/node-opencv/commit/aaece6921d7368577511f06c94c99dd4e9653563 web
https://github.com/peterbraden/node-opencv web
https://www.npmjs.com/advisories/789 web
https://www.npmjs.com/package/opencv web