CVE-2021-32830: Command Injection in @diez/generation
Summary
CVE-2021-32830: Command injection in @diez/generation. Affects @diez/generation versions < 10.6.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @diez/generation npm package is a client for Diez, a design language for building cross-platform UI code. It provides tools and utilities for generating code from design files. The package includes a method called locateFont that is used to locate font files. However, this method is vulnerable to command injection, which allows an attacker to execute arbitrary commands on the system where the code is running. This vulnerability affects all versions of the package.
Vulnerability Detail
The locateFont method in the @diez/generation package is susceptible to command injection. This means that if a client of the library calls this method with untrusted input, an attacker can manipulate the input to execute arbitrary commands on the system. This can lead to remote code execution and potentially compromise the entire system. The vulnerability has a CVSS score of 3.9, indicating a low severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to sanitize and validate any user input before passing it to the locateFont method. This can help prevent command injection attacks by ensuring that the input does not contain any malicious commands. Here's an example of how to sanitize user input in JavaScript:
const userInput = sanitizeUserInput(userInput);
locateFont(userInput);
Conclusion
The @diez/generation package has a command injection vulnerability in the locateFont method. This vulnerability can be mitigated by updating to the latest version of the package and sanitizing user input. It is important to take immediate action to fix this vulnerability and protect your system from potential remote code execution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @diez/generation →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the system where the vulnerable code is running. Depending on the privileges of the user running the code, this can lead to remote code execution and potential compromise of the entire system.
Yes, all versions of the @diez/generation package are vulnerable to this command injection issue.
Yes, the CVSS score for this vulnerability is 3.9, indicating a low severity level.
The best way to mitigate the risk is to update to the latest version of the @diez/generation package, which includes a fix for the command injection vulnerability. Additionally, it is important to sanitize and validate any user input before passing it to the vulnerable method.
You can find more information about this vulnerability in the GitHub Advisory Database. The vulnerability identifier is GHSA-8c3f-x5f9-6h62.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
