Executive brief
heroku-env is a Node.js utility that parses Heroku database configuration and exports it as environment variables for local development. A command injection flaw in the library allows an attacker to execute arbitrary shell commands by manipulating input, potentially gaining full system access on developer machines.
Technical details
heroku-env contains a command injection vulnerability in lib/get.js (the module that parses Heroku configuration). The flaw arises from insufficient input sanitization when constructing shell commands, likely through improper handling of the Heroku app name parameter passed to the heroku CLI command. An attacker who can influence the app name input can inject shell metacharacters to execute arbitrary commands. The vulnerability is present in all versions up to 0.2.0 and affects the command-line tool and programmatic API. No patch is currently available in the advisory; the vulnerability requires manual code review or migration to an alternative solution.
Affected products
- Brian M. Carlson heroku-env 0.2.0 and all previous versions
Timeline
- 2022-08-03: disclosed
- 2022-08-02: advisory: NVD published