Command Injection in local-devices
Summary
GHSA-w725-67p7-xv22: Command Injection in local-devices. Affects local-devices versions < 3.0.0. Fixed in 3.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The local-devices package is an npm package used for retrieving information about devices connected to a local network. It provides functionality to discover and list IP addresses of devices on the network. However, versions prior to 3.0.0 are vulnerable to Command Injection.
Vulnerability Detail
The vulnerability in local-devices arises from the package's failure to validate input on IP addresses. This allows an attacker to inject arbitrary commands into the system by manipulating the IP address input. By exploiting this vulnerability, an attacker can execute unauthorized commands on the target system, potentially leading to unauthorized access, data breaches, or other malicious activities.
How To Fix
Minimum fixed version
3.0.0
This is the first release that contains the fix.
npm install local-devices@3.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The local-devices package prior to version 3.0.0 is vulnerable to Command Injection. It is crucial to upgrade to the fixed version to mitigate the risk of unauthorized command execution. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for local-devices →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the target system, potentially leading to unauthorized access, data breaches, or other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json.
No specific workaround is mentioned for this vulnerability. It is recommended to upgrade to the fixed version of the local-devices package.
There are no known instances of this vulnerability being exploited at the time of this advisory.
This vulnerability was discovered and reported by the GitHub Security Lab.
