Executive brief
Madge is a popular Node.js library for analyzing and visualizing JavaScript module dependencies. The vulnerability allows attackers to execute arbitrary commands on the system when the library is used to generate graphs, images, or SVG output, potentially leading to full system compromise or data theft.
Technical details
Madge versions before 4.0.1 are vulnerable to command injection through the graphVizPath option parameter. When .image(), .svg(), or .dot() functions are called, the unsanitized graphVizPath value is passed directly to child_process.exec(), allowing arbitrary shell command execution. The vulnerability requires that an attacker can control or influence the graphVizPath option value passed to the madge function. The fix, applied in version 4.0.1, sanitizes or properly escapes the graphVizPath parameter before execution.
Affected products
- Madge madge before 4.0.1
Timeline
- 2021-03-09: disclosed: NVD published
- 2021-03-12: disclosed: GitHub advisory published
- 2021-03-12: patched: Fix committed to madge repository
- 2021-03-12: other: Version 4.0.1 released with patch