Executive brief
npm-dependency-versions is a Node.js package that retrieves npm package version information. The package fails to sanitize user-supplied input, allowing attackers to inject arbitrary shell commands that execute with the privileges of the Node.js process. An attacker who can control the input to the package can achieve remote code execution on affected systems.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the npm-dependency-versions package through version 0.3.0. The root cause is that the pkgs parameter passed to the dependencyVersions() function is not sanitized before being used in a shell command execution. An attacker can exploit this by passing a JSON object with shell metacharacters in the pkgs array values (e.g., ["|touch rce"]). The attack requires calling the vulnerable function directly with malicious input; no network access or authentication is required if the attacker can invoke the function. The impact is remote code execution. The vulnerability was disclosed on 2022-04-13 and appears unpatched as of the advisory date.
Affected products
- npm npm-dependency-versions through 0.3.0
Timeline
- 2022-04-13: disclosed
- 2022-04-13: advisory: GHSA-m7xq-8jp8-rj2c published