Executive brief
wc-cmd is a Node.js library for counting words and lines in text. The advisory reports a command injection vulnerability, but this finding has been formally withdrawn and deemed invalid by the CNA. No actual security issue was confirmed to exist.
Technical details
The vulnerability was originally classified as command injection (CWE-77/CWE-78) in the index.js file of wc-cmd, with a proof-of-concept suggesting shell command execution via user input. However, CVE-2020-28431 and the associated advisory GHSA-mx3r-w3pj-7wv7 were both formally withdrawn on 2021-03-23. The CNA determined after further investigation that this was not a valid security issue. No actual vulnerability exists in the package.
Affected products
- npm wc-cmd through 1.0.9
Timeline
- 2020-12-11: disclosed
- 2021-02-23: advisory: NVD published CVE-2020-28431
- 2021-03-23: other: Advisory withdrawn by CNA - deemed not a security issue