Executive brief
cycle-import-check is a Node.js utility for detecting circular dependencies in code projects. A command injection vulnerability in its file handling function allows attackers to execute arbitrary commands on systems running vulnerable versions, potentially compromising build environments and developer machines.
Technical details
The vulnerability is a command injection flaw (CWE-77, CWE-78) in the writeFileToTmpDirAndOpenIt function caused by improper sanitization of user input. An attacker can inject shell metacharacters through malicious input to execute arbitrary commands with the privileges of the process running cycle-import-check. The attack requires no authentication or user interaction and is remotely exploitable via network vectors. All versions before 1.3.2 are affected; a fix is available in version 1.3.2 and later.
Affected products
- cycle-import-check cycle-import-check before 1.3.2
Timeline
- 2022-12-14: disclosed: Vulnerability published in GitHub Advisory Database
- 2022-12-14: patched: Fix available in version 1.3.2