critical9.8
CVE-2018-3786
Command Injection in egg-scripts
Impact
Versions of `egg-scripts` before 2.8.1 are vulnerable to command injection. This is only exploitable if a malicious argument is provided on the command line. Example: `eggctl start --daemon --stderr='/tmp/eggctl_stderr.log; touch /tmp/malicious'` ## Recommendation Update to version 2.8.1 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | egg-scripts | < 2.8.1 | 2.8.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Eggjs | Egg-Scripts | before 2.8.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/eggjs/egg-scripts/blob/2.8.1/History.md
- https://github.com/eggjs/egg-scripts/pull/26
- https://hackerone.com/reports/388936
- https://github.com/advisories/GHSA-c9j3-wqph-5xx9
- https://nvd.nist.gov/vuln/detail/CVE-2018-3786
- https://www.npmjs.com/advisories/694
- https://github.com/eggjs/egg-scripts/commit/b98fd03d1e3aaed68004b881f0b3d42fe47341dd