Executive brief
standard-version is a Node.js library that automates versioning and changelog generation for software projects. A command injection vulnerability in the standardVersion function allows attackers to execute arbitrary system commands if the library processes untrusted input, such as unsanitized release commit message formats, potentially leading to complete system compromise.
Technical details
The standardVersion function is vulnerable to command injection (CWE-77) due to use of shell-interpreting APIs (child_process.exec) on user-supplied strings without proper sanitization. The vulnerability occurs when untrusted input—such as the releaseCommitMessageFormat parameter—is passed to the standardVersion function and is later executed in a shell context. An attacker can inject shell commands using backticks or other shell metacharacters. The fix involves replacing shell-executing APIs with non-shell alternatives like child_process.execFile. The vulnerability affects all versions prior to 8.0.1.
Affected products
- conventional-changelog standard-version < 8.0.1
Timeline
- 2020-07-13: disclosed
- 2020-07-13: patched: Version 8.0.1 released with fix