Executive brief
npm-lockfile is a utility that generates npm package lock files. Versions before 2.0.5 fail to sanitize user-supplied input before executing system commands, allowing an attacker to inject arbitrary OS commands. An attacker can exploit this to execute malicious code with the privileges of the application using the library.
Technical details
This is an OS command injection vulnerability (CWE-78) in npm-lockfile versions 2.0.3 through 2.0.4. The library invokes sensitive command execution APIs with unsanitized external input, specifically failing to properly validate the "only" parameter before passing it to shell execution. The vulnerability is network-reachable and requires no authentication or user interaction—any application using the affected version can be exploited by supplying malicious input to the vulnerable parameter. An attacker can execute arbitrary OS commands with the privileges of the process. The fix was released in version 2.0.5, which rejects invalid "only" values.
Affected products
- npm npm-lockfile 2.0.3 through 2.0.4
Timeline
- 2022-03-04: disclosed
- 2022-03-04: patched: Fix released in version 2.0.5