CVE-2020-7640: OS Command Injection in pixl-class
Summary
CVE-2020-7640: OS Command Injection in pixl-class. Affects pixl-class versions < 1.0.3. Fixed in 1.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pixl-class is an npm package that provides a class-based object-oriented programming framework for JavaScript. It allows developers to create and manage objects with ease. However, prior to version 1.0.3, pixl-class is vulnerable to OS command injection. This means that the 'members' argument of the 'create' function can be controlled by users without any sanitization, leading to the execution of arbitrary commands.
Vulnerability Detail
The OS command injection vulnerability in pixl-class allows an attacker to execute arbitrary commands on the system where the vulnerable package is installed. By manipulating the 'members' argument of the 'create' function, an attacker can inject malicious commands that will be executed by the underlying operating system. This can result in unauthorized access, data breaches, or even complete compromise of the affected system. The vulnerability has a CVSS score of 9.8, indicating its high severity.
How To Fix
Minimum fixed version
1.0.3
This is the first release that contains the fix.
npm install pixl-class@1.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of pixl-class to mitigate the risk of OS command injection.
Conclusion
The OS command injection vulnerability in pixl-class can have severe consequences, including unauthorized access and data breaches. It is crucial to upgrade to the fixed version of the package (1.0.3 or later) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pixl-class →
FAQ
pixl-class is an npm package that provides a class-based object-oriented programming framework for JavaScript.
OS command injection is a vulnerability that allows an attacker to execute arbitrary commands on the underlying operating system.
The vulnerability in pixl-class allows an attacker to execute arbitrary commands on the system where the vulnerable package is installed. This can lead to unauthorized access, data breaches, or complete compromise of the affected system.
The CVSS score of this vulnerability is 9.8, indicating its high severity.
To fix this vulnerability, it is recommended to upgrade to version 1.0.3 or later of the pixl-class package.
