Executive brief
fs-path is a Node.js library for file system operations. Versions before 0.0.25 contain a command injection vulnerability in the copy, copySync, remove, and removeSync methods that can be exploited by supplying malicious input, potentially allowing attackers to execute arbitrary commands on the server.
Technical details
The fs-path Node.js module before version 0.0.25 is vulnerable to command injection (CWE-77) due to insufficient input validation in file operation methods. The copy, copySync, remove, and removeSync methods fail to properly sanitize user-supplied inputs before passing them to shell commands. An attacker with network access can exploit this vulnerability without authentication to execute arbitrary system commands with the privileges of the Node.js process. The vulnerability was patched in version 0.0.25.
Affected products
- fs-path fs-path before 0.0.25
Timeline
- 2021-03-04: disclosed: NVD publication date
- 2021-03-25: advisory: GHSA advisory published
- 2021: patched: Fixed in version 0.0.25