Executive brief
The @ronomon/opened library is a utility for opening files and URLs. A command injection vulnerability allows remote attackers to execute arbitrary system commands if the library processes untrusted input, potentially leading to complete system compromise, data theft, or malware installation.
Technical details
The vulnerability is a command injection flaw (CWE-77) in @ronomon/opened versions before 1.5.2, located in index.js line 87. The library uses child_process.exec() to spawn processes, which interprets its argument as a shell command. Although the library attempted to escape arguments, shell metacharacters could still be injected through untrusted input because exec() re-interprets the escaped string as a command. The attack requires the application to pass untrusted user input to the library function. The fix replaces exec() with execFile(), which spawns the binary with separate arguments that are not subject to shell interpretation.
Affected products
- npm @ronomon/opened before 1.5.2
Timeline
- 2021-05-24: disclosed: NVD publication date
- 2021-05-28: patched: Fix committed to repository
- 2021-06-08: advisory: GHSA advisory published