CVE-2022-0841: OS Command injection in npm-lockfile
Summary
CVE-2022-0841: OS Command injection in npm-lockfile. Affects npm-lockfile versions >= 2.0.3, < 2.0.5. Fixed in 2.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
npm-lockfile is an npm package that generates an npm lockfile and outputs it to a specified filename. It is commonly used in JavaScript projects to manage dependencies and ensure consistent builds. However, versions prior to 2.0.4 of npm-lockfile are vulnerable to OS command injection due to a lack of input sanitization. This allows an attacker to execute arbitrary commands on the host system, potentially leading to unauthorized access, data loss, or other malicious activities.
Vulnerability Detail
The vulnerability in npm-lockfile arises from the unsafe handling of external input. When generating the lockfile, the package does not properly sanitize user-supplied input, which is then used in a sensitive command execution API. This allows an attacker to inject malicious commands into the input and execute them on the host system. The impact of this vulnerability can be severe, as it grants the attacker the ability to execute arbitrary commands with the privileges of the user running the vulnerable npm-lockfile package.
How To Fix
Latest published version: 4.0.0 as of 22 Oct 2026
npm install npm-lockfile@4.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.5
This is the first release that contains the fix.
npm install npm-lockfile@2.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advised to avoid using user-supplied input when generating the lockfile with npm-lockfile. Instead, rely on trusted sources or sanitize the input thoroughly before passing it to the package. Here is an example of how to sanitize the input using the 'shell-quote' npm package:
const shellQuote = require('shell-quote');
const sanitizedInput = shellQuote.quote([userInput]);
By using this workaround, the risk of command injection can be mitigated until the package is updated to a secure version.
Conclusion
In conclusion, the npm-lockfile package prior to version 2.0.4 is vulnerable to OS command injection. This can lead to unauthorized access, data loss, or other malicious activities. It is crucial to upgrade to version 2.0.5 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for npm-lockfile →
FAQ
npm-lockfile is an npm package used to generate an npm lockfile, which ensures consistent dependency versions in JavaScript projects.
OS command injection is a vulnerability that allows an attacker to execute arbitrary commands on the host operating system.
The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary commands with the privileges of the user running the vulnerable npm-lockfile package.
To fix this vulnerability, it is recommended to upgrade to npm-lockfile version 2.0.5 or later.
Yes, a temporary workaround is to avoid using user-supplied input when generating the lockfile with npm-lockfile.
