CVE-2020-7712: Command Injection in json
Summary
CVE-2020-7712: trentm/json vulnerable to command injection. Affects json versions < 10.0.0. Fixed in 10.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The json package is an npm package that provides functionality for working with JSON data. It is widely used in JavaScript applications for parsing and manipulating JSON objects. However, versions before 10.0.0 are vulnerable to command injection due to a flaw in the parseLookup function.
Vulnerability Detail
The vulnerability allows an attacker to inject arbitrary commands using the parseLookup function. This can lead to remote code execution and unauthorized access to the underlying system. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.2. It is important to address this issue promptly to prevent potential exploitation.
How To Fix
Minimum fixed version
10.0.0
This is the first release that contains the fix.
npm install json@10.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the json package to the fixed version.
Conclusion
The json package before version 10.0.0 is vulnerable to command injection. It is crucial to update the package to the latest version to mitigate the risk of remote code execution and unauthorized access. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for json →
FAQ
The vulnerability allows an attacker to execute arbitrary commands, potentially leading to remote code execution and unauthorized access to the system.
Versions before 10.0.0 of the json package are affected by this vulnerability.
Yes, the CVSS score for this vulnerability is 7.2.
There are no known exploits for this vulnerability at the moment.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. No signup is required.
References
Related vulnerabilities
Recent vulnerabilities recorded for json.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
