Executive brief
keep-module-latest is a Node.js package that manages module dependencies. The package fails to sanitize user input passed to the installModule function, allowing attackers with the ability to run Node.js code to execute arbitrary system commands. This could lead to full system compromise including data theft, system modification, and denial of service.
Technical details
The keep-module-latest package contains a command injection vulnerability in the installModule function due to missing input validation and sanitization (CWE-20, CWE-77, CWE-78). The vulnerable code directly constructs shell commands from user-controlled input without proper escaping or sandboxing. An attacker with the ability to execute Node.js code in the target environment can pass malicious input to installModule to break out of the intended command context and execute arbitrary system commands. The vulnerability affects all versions up to and including 1.0.1. No patch information is currently available.
Affected products
- npm keep-module-latest all versions up to 1.0.1
Timeline
- 2023-05-27: disclosed
- 2023-05-30: advisory: GitHub reviewed