Executive brief
global-modules-path is a Node.js utility library used to locate and retrieve paths to globally installed npm modules. Versions before 3.0.0 are vulnerable to command injection attacks through the getPath() function, allowing an attacker to execute arbitrary system commands on a computer running an affected version.
Technical details
The vulnerability is a command injection flaw (CWE-77, CWE-78) in the getPath() function caused by unsafe use of child_process.execSync() with unsanitized user input. An attacker can inject shell commands by passing specially crafted strings as function parameters (e.g., "something & touch abc"). The vulnerability requires no authentication or network access—it is triggered by calling the vulnerable function directly with attacker-controlled input. An attacker exploiting this can achieve arbitrary code execution with the privileges of the Node.js process. The fix, released in version 3.0.0, replaces execSync with spawnSync, which does not interpret shell metacharacters.
Affected products
- npm global-modules-path before 3.0.0
Timeline
- 2023-01-13: disclosed
- 2023-01-08: patched: Version 3.0.0 released with fix using spawnSync instead of execSync