CVE-2020-7632: OS Command Injection in node-mpv
Summary
CVE-2020-7632: OS Command Injection in node-mpv. Affects node-mpv versions < 1.4.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-mpv is an npm package that provides a Node.js interface for controlling the mpv media player. It allows developers to interact with mpv through JavaScript code, enabling them to play, pause, seek, and control various aspects of media playback. However, versions up to 1.4.3 of node-mpv are vulnerable to OS Command Injection. This vulnerability allows an attacker to execute arbitrary commands by exploiting the options argument of the package.
Vulnerability Detail
The OS Command Injection vulnerability in node-mpv arises from insufficient input validation and sanitization. Attackers can craft malicious input that includes arbitrary commands, which are executed by the package without proper validation. This can lead to unauthorized command execution on the host system, potentially resulting in various security risks such as remote code execution, data exfiltration, or system compromise. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization in their own code to mitigate the risk of command injection. By carefully validating and filtering user input before passing it to node-mpv, the likelihood of successful command injection attacks can be reduced. Here is an example of input validation and sanitization using the 'shell-quote' package:
const shellQuote = require('shell-quote');
function sanitizeInput(input) {
return shellQuote.quote([input]);
}
const sanitizedOptions = sanitizeInput(userInput);
mpv.play(sanitizedOptions);
Conclusion
The OS Command Injection vulnerability in node-mpv (CVE-2020-7632) poses a significant security risk, allowing attackers to execute arbitrary commands on the host system. It is crucial for developers to upgrade to a patched version of node-mpv and implement proper input validation and sanitization to prevent command injection attacks. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-mpv →
FAQ
node-mpv is an npm package that provides a Node.js interface for controlling the mpv media player. It allows developers to interact with mpv through JavaScript code, enabling them to play, pause, seek, and control various aspects of media playback.
OS Command Injection is a vulnerability that allows an attacker to execute arbitrary commands on a host system by injecting malicious input. In the case of node-mpv, this vulnerability can be exploited by crafting malicious input in the options argument, leading to unauthorized command execution.
The OS Command Injection vulnerability in node-mpv can result in various security risks, including remote code execution, data exfiltration, or complete system compromise. Attackers can leverage this vulnerability to execute arbitrary commands with the privileges of the user running the affected application.
To fix this vulnerability, it is recommended to upgrade to a patched version of node-mpv (1.4.4 or later). Additionally, ensure that user input is properly validated and sanitized to prevent command injection attacks.
As a temporary workaround, developers can implement input validation and sanitization in their own code to mitigate the risk of command injection. By carefully validating and filtering user input before passing it to node-mpv, the likelihood of successful command injection attacks can be reduced.
