GHSA-wh69-wc6q-7888

Command injection in node-dns-sync

Source: GitHub Advisory Database (reviewed) High CVE-2020-11079

Packages

Ecosystem	Package	Affected	Fixed in
npm	dns-sync	>= 0.1.3, < 0.2.1	0.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

dns-sync through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

References

External links from the advisory. They lead to third-party sites.

https://github.com/skoranga/node-dns-sync/security/advisories/GHSA-wh69-wc6q-7888 web
https://nvd.nist.gov/vuln/detail/CVE-2020-11079 advisory
https://github.com/skoranga/node-dns-sync/commit/cb10a5ac7913eacc031ade7d91596277f31645dc web
https://github.com/skoranga/node-dns-sync package