CVE-2021-29300: Command Injection in @ronomon/opened
Summary
CVE-2021-29300: Command Injection in @ronomon/opened. Affects @ronomon/opened versions < 1.5.2. Fixed in 1.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @ronomon/opened library is an npm package used for handling file and directory operations. It provides various functions and utilities for working with files and directories in a Node.js environment. However, versions before 1.5.2 are vulnerable to a command injection vulnerability.
Vulnerability Detail
The command injection vulnerability in @ronomon/opened allows remote attackers to execute arbitrary commands on the system if the library is used with untrusted input. This can lead to unauthorized access, data leakage, and potential compromise of the entire system. The vulnerability originates from improper input validation and sanitization, allowing malicious commands to be injected and executed by the underlying system.
How To Fix
Latest published version: 1.5.2 as of 23 Oct 2026
npm install @ronomon/opened@1.5.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the library to mitigate the risk of command injection.
Conclusion
In conclusion, the @ronomon/opened library before version 1.5.2 is vulnerable to a critical command injection vulnerability. It is crucial to upgrade to the fixed version and ensure proper input validation and sanitization to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @ronomon/opened →
FAQ
The vulnerability allows remote attackers to execute arbitrary commands on the system, potentially leading to unauthorized access, data leakage, and compromise of the entire system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json without requiring access to the code or installation.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to patch the vulnerability as soon as possible to prevent potential exploitation.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-fg5w-w99f-rj6w/GHSA-fg5w-w99f-rj6w.json
