Command Injection in dns-sync
Summary
GHSA-c6h2-mpc6-232h: Command Injection in dns-sync. Affects dns-sync versions < 0.1.3. Fixed in 0.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dns-sync package is an npm package that provides a synchronous DNS resolver for Node.js applications. It allows developers to perform DNS lookups and resolve hostnames synchronously within their code. This package is vulnerable to a command injection vulnerability.
Vulnerability Detail
The command injection vulnerability in dns-sync allows an attacker to execute arbitrary commands on the host system by injecting malicious input into the DNS lookup function. This can lead to remote code execution and unauthorized access to the host system. The vulnerability is considered moderate in severity.
How To Fix
Latest published version: 0.2.1 as of 23 Oct 2026
npm install dns-sync@0.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.3
This is the first release that contains the fix.
npm install dns-sync@0.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the dns-sync package to mitigate the risk.
Conclusion
The command injection vulnerability in dns-sync can lead to remote code execution and unauthorized access. It is crucial to upgrade to version 0.1.3 or later of the dns-sync package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dns-sync →
FAQ
The vulnerability allows an attacker to execute arbitrary commands on the host system, potentially leading to remote code execution and unauthorized access.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, upgrading to version 0.1.3 or later of the dns-sync package fixes this vulnerability. Make sure to update your package.json file and install the updated package.
There are no known workarounds for this vulnerability. Upgrading to the fixed version of the dns-sync package is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-c6h2-mpc6-232h/GHSA-c6h2-mpc6-232h.json
References
Related vulnerabilities
Recent vulnerabilities recorded for dns-sync.
