critical9.8
CVE-2020-7602
OS Command Injection in node-prompt-here
Impact
node-prompt-here through 1.0.1 allows execution of arbitrary commands. The `runCommand()` is called by `getDevices()` function in file `linux/manager.js`, which is required by the `index. process.env.NM_CLI` in the file `linux/manager.js`. This function is used to construct the argument of function `execSync()`, which can be controlled by users without any sanitization.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | node-prompt-here | <= 1.0.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Node-Prompt-Here Project | Node-Prompt-Here | through 1.0.1 |