Executive brief
script-manager is a Node.js npm package used for managing and executing scripts in applications. Versions 0.8.6 and earlier contain a code injection vulnerability that allows attackers to execute arbitrary code remotely without authentication, potentially compromising any application or service that depends on this library.
Technical details
The vulnerability is a code injection flaw (CWE-94) caused by an unintended require statement in script-manager npm package versions 0.8.6 and earlier. An attacker can inject malicious code that gets executed during the require process, leading to arbitrary code execution. The attack vector is network-based with no authentication required, no user interaction needed, and low attack complexity. Any application using the affected versions is at risk of remote code execution. The vulnerability was fixed in version 0.9.0.
Affected products
- script-manager script-manager 0.8.6 and earlier
Timeline
- 2021-04-13: disclosed
- 2021-04-13: patched: Fixed in version 0.9.0