Executive brief
node-mpv is a Node.js library that controls the MPV media player. A command injection vulnerability in the options parameter allows an attacker to execute arbitrary operating system commands with the privileges of the application using the library. This could lead to complete compromise of systems that rely on node-mpv.
Technical details
node-mpv through version 1.4.3 contains an OS command injection vulnerability (CWE-78) in its options argument handling. The vulnerable code in lib/util.js passes unsanitized user input directly to the child_process.exec() function, which invokes a shell to execute the command. An attacker can inject shell metacharacters and arbitrary commands through the options parameter without requiring authentication or user interaction. Exploitation allows arbitrary command execution with the privileges of the process running node-mpv. The vulnerability affects all versions up to and including 1.4.3.
Affected products
- node-mpv node-mpv through 1.4.3
Timeline
- 2020-04-06: disclosed: CVE-2020-7632 published by NVD
- 2022-01-07: advisory: GHSA-cqr2-xhg6-p268 advisory published