Описание
Command Injection in whereis
Versions of whereis before 0.4.1 are vulnerable to command injection if untrusted user input is passed into whereis.
Recommendation
Update to version 0.4.1 or later.
Пакеты
Наименование
whereis
npm
Затронутые версииВерсия исправления
< 0.4.1
0.4.1
Связанные уязвимости
CVSS3: 9.8
nvd
больше 7 лет назад
Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` module is deprecated and it is recommended to use the `which` npm module instead.