Executive brief
create-choo-app3 is a Node.js package for scaffolding new Choo web applications. The package contains a command injection vulnerability in the devInstall function that allows a local attacker with existing access to execute arbitrary commands during installation, potentially compromising the entire development environment and project code.
Technical details
The vulnerability is a command injection flaw (CWE-77/CWE-78) in the devInstall function caused by improper sanitization of user-supplied input before passing it to a shell execution context. An attacker with local access to the system can inject malicious shell commands through the project setup process. The attack requires local privileges and user interaction to trigger the vulnerable code path. Successful exploitation allows arbitrary command execution with the privileges of the user running the installation. All versions up to 1.12.3 are affected, with no patched version mentioned in the advisory.
Affected products
- choojs create-choo-app3 all versions up to 1.12.3
Timeline
- 2023-02-06: disclosed
- 2023-02-06: advisory