Junglewise Threat Intelligence

CVE-2020-7795: get-npm-package-version command injection

CVE-2020-7795 · Severity: low · CVSS 3.1 · Published 2022-08-03

Vendors: npm.

Executive brief

get-npm-package-version is a utility library used by Node.js applications to retrieve npm package version information. A command injection vulnerability in versions before 1.0.7 allows attackers to execute arbitrary shell commands on systems using this library. An attacker could exploit this to gain remote code execution, steal sensitive data, or compromise affected systems if the library is used in a web application or server-side context.

Technical details

This is a command injection vulnerability (CWE-77/CWE-78) in the main function of index.js where user-supplied input is directly interpolated into shell commands executed via child_process.execSync(). Specifically, the packageName and registry parameters are unsanitized and passed into npm command strings like `npm view ${packageName} version --registry ${registry}`. An attacker can inject special shell characters (backticks, $, &, {}, [, ;, |) via these parameters to execute arbitrary commands. The attack vector is network-accessible if the library is exposed through a web API or server application. Exploitation requires only the ability to control the packageName or registry parameter—no authentication is required. The fix, introduced in version 1.0.7, implements input validation using a regex pattern to block dangerous characters before command execution.

Affected products

  • hoperyy get-npm-package-version <1.0.7

Timeline

  • 2020-12-11: disclosed: Vulnerability disclosed
  • 2022-08-03: advisory: GHSA advisory published
  • 2022: patched: Fixed in version 1.0.7 with input validation

References