Executive brief
enpeem is a Node.js library that manages npm package dependencies programmatically. The vulnerability allows attackers to execute arbitrary system commands by injecting malicious input through the options.dir parameter, potentially compromising any application that uses this library to install or manage packages.
Technical details
enpeem through version 2.2.0 contains an OS command injection vulnerability (CWE-78) in its core command execution logic. The "options.dir" argument is passed directly to Node.js's child_process.exec() function without any sanitization or escaping. An attacker can craft malicious input containing shell metacharacters to break out of the intended npm command and execute arbitrary shell commands. The attack requires only the ability to provide input to the options.dir parameter (no authentication required). This results in complete command execution with the privileges of the Node.js process. The vulnerability was patched after version 2.2.0; the repository was archived in August 2021.
Affected products
- enpeem enpeem through 2.2.0
Timeline
- 2020-02-28: disclosed
- 2021-04-13: advisory