CVE-2020-8186: Injection and Command Injection in devcert
Summary
CVE-2020-8186: Injection and Command Injection in devcert. Affects devcert versions < 1.1.2. Fixed in 1.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The devcert package is an npm module used for generating SSL/TLS certificates for development purposes. It provides a convenient way for developers to create self-signed certificates and enable HTTPS on their local development environments. The package is widely used in various projects and ecosystems.
Vulnerability Detail
A command injection vulnerability has been discovered in the devcert module. This vulnerability arises when untrusted user input is passed to the certificateFor function. An attacker can exploit this vulnerability to execute arbitrary commands on the target system, potentially leading to remote code execution. The impact of this vulnerability is severe, as it allows an attacker to gain unauthorized access and control over the affected system.
How To Fix
Latest published version: 1.2.3 as of 23 Oct 2026
npm install devcert@1.2.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.2
This is the first release that contains the fix.
npm install devcert@1.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization measures to mitigate the risk of command injection. It is essential to carefully validate and sanitize any user input before using it in commands or functions. By enforcing strict input validation, developers can prevent malicious input from being executed as commands.
Conclusion
The devcert package is affected by a command injection vulnerability that can result in remote code execution. It is crucial to update to version 1.1.2 or later and implement input validation/sanitization to prevent exploitation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for devcert →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the target system, potentially leading to remote code execution. It can result in unauthorized access and control over the affected system.
To fix this vulnerability, update the devcert package to version 1.1.2 or later. Ensure that your projects are using the latest version and validate/sanitize user input to prevent command injection.
As a temporary workaround, implement input validation and sanitization measures to mitigate the risk of command injection. Validate and sanitize user input before using it in commands or functions.
Yes, this vulnerability can be exploited remotely. An attacker can send malicious input to the certificateFor function, leading to command injection and potential remote code execution.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to apply the recommended fixes and preventive measures to ensure the security of your systems.
References
Related vulnerabilities
Recent vulnerabilities recorded for devcert.
