~ / search / GHSA-r9vm-rhmf-7hxx

GHSA-r9vm-rhmf-7hxx

OS Command Injection in im-resize

Source: GitHub Advisory Database (reviewed) High CVE-2019-10787

Packages

EcosystemPackageAffectedFixed in
npm im-resize <= 2.3.2 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization.

References

External links from the advisory. They lead to third-party sites.