CVE-2021-23378: Command Injection in picotts
Summary
CVE-2021-23378: Command Injection in picotts. Affects picotts versions < 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
picotts is an npm package that provides text-to-speech functionality. It allows users to convert text into spoken words using various voices and languages. The package utilizes the child_process exec function to execute system commands. However, prior to version 0.1.2, the package does not properly sanitize user input provided to the say function, which can lead to command injection vulnerabilities.
Vulnerability Detail
The vulnerability (CVE-2021-23378) arises from the lack of input sanitization in the say function of picotts. If an attacker can control the user input passed to this function, they can inject arbitrary commands, which will be executed by the child_process exec function. This can result in unauthorized access, data leakage, or even complete compromise of the system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually sanitize user input before passing it to the say function. This can be done by using a library or function that escapes or removes any special characters that could be used for command injection. Here's an example of how to sanitize user input using the 'shell-quote' library in Node.js:
const shellQuote = require('shell-quote');
const userInput = 'Hello; rm -rf /';
const sanitizedInput = shellQuote.quote([userInput]);
say(sanitizedInput);
By properly sanitizing the input, the risk of command injection can be mitigated.
Conclusion
In conclusion, the picotts package is vulnerable to command injection up to version 0.1.1. It is crucial to upgrade to version 0.1.2 or later to mitigate this vulnerability. If immediate upgrade is not possible, manual input sanitization can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for picotts →
FAQ
picotts is an npm package that provides text-to-speech functionality, allowing users to convert text into spoken words using various voices and languages.
Command injection is a security vulnerability that occurs when an attacker is able to inject malicious commands into a system, which are then executed by the application or underlying system.
If exploited, this vulnerability allows an attacker to execute arbitrary commands on the system where picotts is installed. This can lead to unauthorized access, data leakage, or complete compromise of the system.
To fix this vulnerability, it is recommended to upgrade to version 0.1.2 or later of the picotts package. Alternatively, you can manually sanitize user input before passing it to the say function.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
