Executive brief
plotter is a Node.js package used to generate plots and charts. The package fails to properly sanitize plot titles, allowing an attacker to inject arbitrary system commands that will be executed with the privileges of the application. An attacker can exploit this to execute malicious code, potentially leading to data theft, system compromise, or service disruption.
Technical details
This is a command injection vulnerability (CWE-77) in the plotter npm package. The vulnerability exists because the package does not sanitize the plot title parameter before passing it to an underlying plotting command (likely gnuplot). An attacker can inject shell metacharacters and commands via the title field; no authentication or special preconditions are required—exploitation occurs when user-supplied input is passed to the plot() function. An attacker can achieve arbitrary command execution with the privileges of the Node.js process. No fix is currently available; users are advised to use alternative packages.
Affected products
- npm plotter all versions
Timeline
- 2020-09-04: disclosed
- 2020-09-04: advisory: GHSA-65xx-c85x-wg76 published