Executive brief
xopen is a Node.js library that opens files with the default application on Windows, macOS, and Linux. A command injection vulnerability in the core xopen() function allows an attacker to execute arbitrary operating system commands by passing a malicious filepath, potentially leading to complete system compromise including data theft, modification, or service disruption.
Technical details
The vulnerability is a classic OS command injection (CWE-78) affecting the xopen(filepath) exported function, with the injection point in line 14 of index.js. The root cause is improper neutralization of special elements used in an OS command. An attacker can exploit this by supplying a specially crafted filepath argument containing shell metacharacters or command substitution sequences. No authentication or user interaction is required—any code that passes untrusted input directly to xopen() is vulnerable. A successful attack allows arbitrary command execution with the privileges of the Node.js process. All versions through 1.0.0 are affected.
Affected products
- xopen xopen 0 to 1.0.0
Timeline
- 2022-07-26: disclosed
- 2020: other: CVE-2020-28447 assigned; vulnerability existed in earlier years