Executive brief
jison is a JavaScript parser generator library used to create custom language parsers. A command injection vulnerability in jison versions up to 0.4.18 could allow attackers to execute arbitrary system commands. However, the vulnerability exists only in the repository source code and not in the released npm package, significantly limiting practical risk.
Technical details
The vulnerability is a command injection flaw (CWE-78) caused by insufficient input validation in jison versions up to 0.4.18. The vulnerable code is present in the GitHub repository but was not included in the distributed npm package, which limits real-world exposure. An attacker with the ability to influence parser generation input could potentially execute arbitrary OS commands. The vulnerability has been withdrawn by the advisory maintainers after clarification that production users of the npm package are not affected.
Affected products
- jison jison <=0.4.18
Timeline
- 2020-10-08: disclosed
- 2020-10-19: other: Advisory withdrawn - vulnerability not present in released npm package