Executive brief
opencv is a Node.js binding for OpenCV, a popular computer vision library used in image processing and video analysis applications. A command injection vulnerability in the build utility script allows attackers to execute arbitrary system commands during package installation or build, potentially compromising the build environment and enabling malware deployment.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the utils/find-opencv.js script that fails to properly validate user input before passing it to shell execution. An attacker can inject arbitrary shell commands through unvalidated parameters during the npm package installation or build process. The attack requires local access or the ability to influence the build environment (e.g., via a compromised dependency or malicious environment variables). The fix was applied in version 6.1.0 by removing untrusted input from exec calls.
Affected products
- <UNKNOWN> opencv before 6.1.0
Timeline
- 2019-06-04: disclosed
- 2019-06-04: patched: Fixed in version 6.1.0