Executive brief
mversion is a Node.js library used to manage semantic versioning of software packages. A command injection vulnerability allows attackers with local access to execute arbitrary system commands by crafting malicious tag names, potentially leading to unauthorized code execution and system compromise.
Technical details
The vulnerability is an OS command injection (CWE-78) in mversion's version management functionality. User-supplied tagName input is passed unsanitized into an exec() function call, allowing arbitrary shell command execution. The attack requires local access to the system running mversion, with no special privileges or authentication required beyond the ability to invoke the library. An attacker can exploit this to execute arbitrary commands with the privileges of the process running mversion. The vulnerability was fixed in version 2.0.1; versions up to 1.13.0 are affected.
Affected products
- mversion mversion <= 1.13.0
Timeline
- 2020-06-23: disclosed: Vulnerability reported to 418sec huntr
- 2021-05-17: patched: Advisory published; fix available in version 2.0.1
- 2021-05-17: advisory