critical9.8
CVE-2019-10791
promise-probe OS command injection vulnerability
Impact
promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The `file`, `outputFile` and `options` functions can be controlled by users without any sanitization.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | promise-probe | < 0.1.10 | 0.1.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Promise-Probe Project | Promise-Probe | before 0.10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/dottgonzo/node-promise-probe/commit/0d9affb67fc1ad985903536d35372cf55efe5a45%2C
- https://snyk.io/vuln/SNYK-JS-PROMISEPROBE-546816
- https://github.com/advisories/GHSA-vmqq-7qvx-68qx
- https://nvd.nist.gov/vuln/detail/CVE-2019-10791
- https://github.com/dottgonzo/node-promise-probe/commit/0d9affb67fc1ad985903536d35372cf55efe5a45