CVE-2020-7688: OS Command Injection in mversion
Summary
CVE-2020-7688: OS Command Injection in mversion. Affects mversion versions < 2.0.1. Fixed in 2.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mversion package is an npm package used for managing version numbers in projects. It provides a command-line interface and an API for updating version numbers in package.json files. This vulnerability allows for OS command injection due to the lack of input validation when formatting user input. An attacker can exploit this vulnerability to execute arbitrary commands on the host system.
Vulnerability Detail
The vulnerability arises from the execution of user input without proper validation or sanitization. Specifically, the tagName input is directly formatted inside the exec function, allowing for command injection. An attacker can craft malicious input that includes arbitrary commands, which will be executed by the application. This can lead to unauthorized access, data leakage, or even complete compromise of the host system.
How To Fix
Minimum fixed version
2.0.1
This is the first release that contains the fix.
npm install mversion@2.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately possible, a temporary workaround is to avoid using user input directly in the tagName parameter. Instead, ensure that any user input is properly validated and sanitized before being used in the exec function.
Conclusion
The mversion package is vulnerable to OS command injection, which can lead to unauthorized access, data leakage, or compromise of the host system. It is crucial to update the package to version 2.0.1 or higher to mitigate this vulnerability. If immediate update is not possible, ensure proper validation and sanitization of user input to prevent exploitation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for mversion →
FAQ
mversion is an npm package used for managing version numbers in projects. It provides a command-line interface and an API for updating version numbers in package.json files.
OS command injection is a vulnerability that allows an attacker to execute arbitrary commands on the host operating system. It occurs when user input is not properly validated or sanitized before being executed as a command.
This vulnerability allows an attacker to execute arbitrary commands on the host system. Depending on the privileges of the application, this can lead to unauthorized access, data leakage, or complete compromise of the system.
To fix this vulnerability, update the mversion package to version 2.0.1 or higher. Run the command 'npm install mversion@latest' to update the package.
If updating the package is not immediately possible, avoid using user input directly in the tagName parameter. Validate and sanitize any user input before using it in the exec function.
References
Related vulnerabilities
Recent vulnerabilities recorded for mversion.
