Описание
Arbitrary Code Execution in require-node
Versions of require-node prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the require-node endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body.
Recommendation
- If you are using 1.x, upgrade to version 1.3.4 or later.
- If you are using 2.x, upgrade to version 2.0.4 or later.
Пакеты
Наименование
require-node
npm
Затронутые версииВерсия исправления
< 1.3.4
1.3.4
Наименование
require-node
npm
Затронутые версииВерсия исправления
>= 2.0.0, < 2.0.4
2.0.4
Дефекты
CWE-78
Дефекты
CWE-78