GHSA-vvj3-85vf-fgmw

global-modules-path Command Injection vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-21191

Packages

Ecosystem	Package	Affected	Fixed in
npm	global-modules-path	< 3.0.0	3.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-21191 advisory
https://github.com/rosen-vladimirov/global-modules-path/commit/edbdaff077ea0cf295b1469923c06bbccad3c180 web
https://github.com/lorenzomigliorero/npm-node-utils/blob/b55dd81c597db657c9751332bb2242403fd3e26b/index.js%23L186 web
https://github.com/rosen-vladimirov/global-modules-path package
https://github.com/rosen-vladimirov/global-modules-path/releases/tag/v3.0.0 web
https://security.snyk.io/vuln/SNYK-JS-GLOBALMODULESPATH-3167973 web