Command Injection in node-opencv
Summary
CVE-2019-10061: utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. Affects node-opencv across 3 version ranges.
< 6.0.0+git20180416.cfc96ba0-3
< 81a4b8620188e89f7e4fc985f3c89b58d4bcc86b
< aaece6921d7368577511f06c94c99dd4e9653563
Fixed in 6.0.0+git20180416.cfc96ba0-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-opencv is a package that provides OpenCV bindings for Node.js. It allows developers to use the OpenCV library in their Node.js applications for computer vision and image processing tasks. However, versions prior to 6.1.0 are vulnerable to Command Injection.
Vulnerability Detail
The vulnerability (CVE-2019-10061) exists in the 'utils/find-opencv.js' file of node-opencv. It arises due to the lack of user input validation, which enables attackers to execute arbitrary commands. This can lead to unauthorized access, data leakage, or even complete compromise of the affected system.
How To Fix
Minimum fixed version
6.0.0+git20180416.cfc96ba0-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version as soon as possible to ensure the security of your application.
Conclusion
In conclusion, the command injection vulnerability in node-opencv (CVE-2019-10061) can have severe consequences, including unauthorized access and data compromise. It is crucial to update to version 6.1.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for node-opencv →
FAQ
node-opencv is a package that provides OpenCV bindings for Node.js, allowing developers to utilize OpenCV's computer vision capabilities in their Node.js applications.
Command Injection is a security vulnerability that occurs when an application allows user-supplied input to be executed as a command. Attackers can exploit this vulnerability to execute arbitrary commands, potentially leading to unauthorized access or data compromise.
The command injection vulnerability in node-opencv can allow attackers to execute arbitrary commands on the affected system. This can lead to unauthorized access, data leakage, or even complete compromise of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
You can find more information about this vulnerability, including its CVSS score and technical details, in the CVE-2019-10061 JSON report available at https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10061.json
Related vulnerabilities
Recent vulnerabilities recorded for node-opencv.
