Executive brief
@rkesters/gnuplot is a Node.js library for generating charts using gnuplot and ps2pdf. Versions before 0.1.1 are vulnerable to code injection via shell metacharacters in gnuplot commands, allowing an attacker to execute arbitrary system commands and take full control of the affected system.
Technical details
The vulnerability is a command injection flaw (CWE-77, CWE-78) in the gnuplot library prior to version 0.1.1. The library fails to properly sanitize shell metacharacters in gnuplot commands before passing them to the shell, allowing attackers to inject arbitrary shell commands. The attack requires network access to an application using the vulnerable library, with no authentication or user interaction needed. An unauthenticated attacker can achieve remote code execution with full system privileges. The fix, available in version 0.1.1, implements filename validation to prevent shell metacharacter injection.
Affected products
- @rkesters gnuplot before 0.1.1
Timeline
- 2021-05-03: disclosed: Published to NVD
- 2021-05-19: patched: Fixed in version 0.1.1 with filename validation
- 2022-02-10: advisory: GitHub advisory published