CVE-2020-28439: Command Injection in corenlp-js-prefab
Summary
CVE-2020-28439: Command injection in corenlp-js-prefab. Affects corenlp-js-prefab versions < 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
corenlp-js-prefab is an npm package that provides a JavaScript interface for the CoreNLP (Core Natural Language Processing) library. It allows developers to perform various natural language processing tasks such as tokenization, part-of-speech tagging, and named entity recognition. This vulnerability affects all versions of corenlp-js-prefab and is dependent on the vulnerable package corenlp-js-interface.
Vulnerability Detail
The vulnerability in corenlp-js-prefab is a command injection vulnerability located in line 10 of the 'index.js' file. This vulnerability allows an attacker to execute arbitrary commands on the host system by manipulating user-supplied input. The impact of this vulnerability can be severe, as it can lead to unauthorized access, data leakage, and remote code execution. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-78.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version as soon as possible.
Conclusion
The command injection vulnerability in corenlp-js-prefab can have severe consequences, including unauthorized access and remote code execution. It is recommended to update to version 1.0.2 of the package to mitigate this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for corenlp-js-prefab →
FAQ
corenlp-js-prefab is an npm package that provides a JavaScript interface for the CoreNLP library, allowing developers to perform natural language processing tasks.
This vulnerability allows an attacker to execute arbitrary commands on the host system, potentially leading to unauthorized access, data leakage, and remote code execution.
All versions of corenlp-js-prefab are affected up to and including version 1.0.1.
Yes, upgrading to version 1.0.2 of corenlp-js-prefab fixes this vulnerability.
No, there are no known workarounds for this vulnerability. It is crucial to update to the patched version.
