Executive brief
The p4 npm package is a Node.js library for executing Perforce commands. It is vulnerable to command injection through improper input sanitization in the run() function, allowing attackers to inject arbitrary shell commands and potentially compromise systems using this package.
Technical details
The p4 npm package before version 0.0.7 contains a command injection vulnerability (CWE-78) in the run() function due to improper input sanitization. An attacker can pass malicious input containing shell metacharacters that are not properly escaped before being executed via system calls. The vulnerability can be exploited by an application that uses the p4 library and passes untrusted input to the run() function without validation. Successful exploitation allows arbitrary command execution on the system with the privileges of the process running the vulnerable code. The vulnerability was patched in version 0.0.7.
Affected products
- npm p4 before 0.0.7
Timeline
- 2022-12-20: disclosed
- 2022-12-20: patched: Fixed in version 0.0.7