Executive brief
The 'open' package for Node.js, used to open URLs or files in a user's default browser or application, is vulnerable to command injection. If an application passes untrusted user input directly to this library, an attacker could execute arbitrary commands on the underlying server or workstation. This could lead to full system compromise, data theft, or unauthorized access to internal resources.
Technical details
Versions of the 'open' npm package prior to 6.0.0 are vulnerable to command injection (CWE-77). The vulnerability exists because the package passes input to a new shell using child_process.exec without sufficient sanitization. An attacker who can control the input passed to the open() function can execute arbitrary system commands with the privileges of the Node.js process. This is particularly dangerous in server-side environments or CLI tools that handle external data. The issue is addressed in version 6.0.0, though users should note that 'open' is the successor to the 'opn' package and may require API adjustments during upgrade.
Affected products
- npm open < 6.0.0
Timeline
- 2019-06-20: advisory: GitHub Advisory published
- 2019-06-20: disclosed: GitHub review completed