Executive brief
corenlp-js-prefab is a Node.js library wrapper for natural language processing that allows developers to process text without writing detailed configuration code. A command injection vulnerability in this library allows attackers to execute arbitrary system commands by supplying specially crafted text input, potentially leading to complete compromise of any system running the vulnerable package.
Technical details
This is a command injection vulnerability (CWE-78) in the corenlp-js-prefab npm package, located in index.js at line 10. The vulnerability stems from unsafe handling of user-supplied input that is passed to an underlying vulnerable dependency (corenlp-js-interface) without proper sanitization. The vulnerability is remotely exploitable over the network with no authentication or user interaction required. An attacker can execute arbitrary shell commands on the affected system, gaining full control over the process and the system it runs on. The package is deprecated with no patch available; users should migrate to an alternative library.
Affected products
- corenlp-js-prefab corenlp-js-prefab all versions up to and including 1.0.1
Timeline
- 2020-12-11: disclosed
- 2021-04-13: advisory