critical9.8
CVE-2017-1000219
Command Execution in windows-cpu
Impact
Version of `windows-cpu` before 0.1.5 will execute arbitrary code passed into the first argument of the `findLoad` method, resulting in remote code execution. ## Proof of Concept ```js var win = require('windows-cpu'); wind.findLoad('foo & calc.exe'); ``` ## Recommendation Update to version 0.1.5 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | windows-cpu | < 0.1.5 | 0.1.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Windows-Cpu Project | Windows-Cpu | Versions 0.1.1, 0.1.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://nodesecurity.io/advisories/336
- https://github.com/advisories/GHSA-63m4-fhf2-cmf7
- https://github.com/KyleRoss/windows-cpu/commit/b75e19aa2f7459a9506bceb577ba2341fe273117
- https://github.com/KyleRoss/windows-cpu/blob/master/index.js#L81
- https://www.npmjs.com/advisories/336
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000219