Executive brief
Prisma SDK is a development library used to build and test the Prisma ORM CLI. A command injection vulnerability in the getPackedPackage function could allow an attacker to execute arbitrary code if untrusted input is passed to this internal function. While the function is not publicly advertised and is only used internally for testing and CLI building, exploitation would result in remote code execution.
Technical details
A command injection vulnerability (CWE-78) exists in the @prisma/sdk getPackedPackage function, where untrusted input is not properly sanitized before being passed to shell commands. The vulnerability requires that a client library calls the vulnerable method with untrusted input; the attack vector is network-based if the SDK is exposed through a web service or similar. An attacker can inject shell metacharacters to execute arbitrary commands with the privileges of the process running the SDK. The vulnerability has been fixed in @prisma/sdk version 2.20.0 and later.
Affected products
- Prisma SDK before 2.20.0
Timeline
- 2021-03-31: disclosed
- 2021-04-06: patched: Fixed in @prisma/sdk@2.20.0