Executive brief
command-exists is a Node.js library that checks whether commands are available on the system. Versions before 1.2.4 contain a command injection vulnerability that allows an attacker to execute arbitrary system commands if untrusted user input is passed to the module without proper sanitization.
Technical details
The vulnerability is a command injection flaw (CWE-77) in command-exists versions prior to 1.2.4. The root cause lies in insufficient input validation when processing command names; user-supplied input is passed unsanitized to shell execution contexts. The attack vector is local/application-level, requiring that an application using this library passes untrusted user input directly to the command-exists API without prior validation. An attacker can inject shell metacharacters or command separators to execute arbitrary commands with the privileges of the Node.js process. The fix is available in version 1.2.4 and later, which implements proper input escaping to prevent command injection.
Affected products
- command-exists command-exists before 1.2.4
Timeline
- 2019-06-03: disclosed
- 2019-06-03: patched: Fixed in version 1.2.4