Executive brief
The whereis npm package is a utility for locating executable binaries on Unix-like systems. A command injection vulnerability allows attackers to execute arbitrary system commands by passing specially crafted arguments to the package. This advisory has been withdrawn as a duplicate of another report.
Technical details
The vulnerability is a command injection flaw in the whereis library that fails to properly escape or sanitize arguments passed to system commands. An attacker can inject arbitrary shell commands through specially crafted input, leading to command execution. The vulnerability affects all versions prior to 0.4.1, which introduced argument escaping. No authentication is required; exploitation occurs when untrusted input is passed to the library's functions. This advisory was withdrawn as it is a duplicate of GHSA-wjr4-2jgw-hmv8.
Affected products
- npm whereis <0.4.1
Timeline
- 2020-08-03: disclosed
- 2020-08-03: patched: Fix applied in version 0.4.1