critical9.8
CVE-2022-21129
nemo-appium vulnerable to OS Command Injection
Impact
Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. **Note:** In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | nemo-appium | < 0.0.9 | 0.0.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Paypal | Nemo-Appium | before 0.0.9 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/paypal/nemo-appium/blob/master/index.js%23L27
- https://github.com/paypal/nemo-appium/commit/aa271d36dd5c81baae3c43aa2616c84f0ee4195f
- https://security.snyk.io/vuln/SNYK-JS-NEMOAPPIUM-3183747
- https://github.com/advisories/GHSA-c6rx-gxqv-vr5j
- https://nvd.nist.gov/vuln/detail/CVE-2022-21129