Executive brief
cocos-utils is a Node.js utility library used in development workflows. A command injection vulnerability in the unzip() function allows attackers to execute arbitrary system commands on servers or developer machines running vulnerable versions of the library, potentially leading to complete system compromise.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the unzip() function that concatenates user-controlled input directly into an exec() call without proper sanitization. An attacker can supply malicious input that breaks out of the intended command and executes arbitrary shell commands on the system. The attack requires the application to pass untrusted data to the unzip() function. No patch is currently available, and all versions of cocos-utils are affected.
Affected products
- cocos-utils cocos-utils all versions
Timeline
- 2020-09-02: disclosed