high7.8
CVE-2022-25350
Command Injection in puppet-facter
Impact
All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | puppet-facter | <= 0.0.2 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Helecloud | Puppet-Facter | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/olindata/node-puppet-facter/blob/f34bcc754325d71bb3b1b534804e53d6170f15f5/index.js%23L10
- https://security.snyk.io/vuln/SNYK-JS-PUPPETFACTER-3175616
- https://github.com/advisories/GHSA-g5qr-xgg7-8q2w
- https://nvd.nist.gov/vuln/detail/CVE-2022-25350
- https://github.com/olindata/node-puppet-facter/blob/f34bcc754325d71bb3b1b534804e53d6170f15f5/index.js#23L10