Executive brief
Versionn is a Node.js library used for version management and parsing. A command injection vulnerability in versions prior to 1.1.0 allows attackers to execute arbitrary system commands, potentially leading to complete compromise of systems using this library including data theft, system manipulation, and service disruption.
Technical details
The vulnerability is a command injection flaw (CWE-77) affecting all versions of versionn prior to 1.1.0. The vulnerability allows unauthenticated, network-based exploitation with no user interaction required. An attacker can inject shell commands through the library's input handling, achieving arbitrary command execution with the privileges of the application using versionn. The vulnerability has been patched in version 1.1.0, available via npm.
Affected products
- Versionn versionn <1.1.0
Timeline
- 2023-02-22: disclosed: GHSA-fj78-2vc5-f6cm advisory published
- 2023-02-22: patched: Version 1.1.0 released with fix