GHSA-wp7m-mrvf-599c

Command Injection in node-df

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-15597

Packages

Ecosystem	Package	Affected	Fixed in
npm	node-df	<= 0.1.4	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of `node-df` are vulnerable to Command Injection. The package fails to sanitize filenames passed to the `file` option. If this value is user-controlled it may allow attackers to run arbitrary commands in the server. ## Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-15597 advisory
https://hackerone.com/reports/703412 web
https://github.com/adriano-di-giovanni/node-df package
https://www.npmjs.com/advisories/1431 web