Command Injection in node-wifi
Summary
GHSA-4x6x-782q-jfc4: Command Injection in node-wifi. Affects node-wifi versions < 2.0.12. Fixed in 2.0.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
node-wifi is an npm package that provides a simple interface to manage Wi-Fi connections on a system. It allows users to connect to Wi-Fi networks, scan for available networks, and perform other Wi-Fi related operations. However, versions prior to 2.0.12 are vulnerable to a Command Injection vulnerability.
Vulnerability Detail
The Command Injection vulnerability in node-wifi arises from a failure to properly sanitize user input. Specifically, the package does not adequately validate the 'ssid' variable, which can be exploited by attackers to inject arbitrary commands. This can lead to Remote Code Execution on the system, potentially allowing an attacker to take control of the affected system.
How To Fix
Minimum fixed version
2.0.12
This is the first release that contains the fix.
npm install node-wifi@2.0.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As there is no fix available, it is advisable to switch to an alternative package that does not suffer from this vulnerability. This will help mitigate the risk of command injection and potential remote code execution.
Conclusion
In conclusion, node-wifi versions prior to 2.0.12 are vulnerable to a Command Injection vulnerability that can lead to Remote Code Execution. As no fix is currently available, it is advised to switch to an alternative package to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-wifi →
FAQ
node-wifi is an npm package that provides a simple interface to manage Wi-Fi connections on a system.
Command Injection is a vulnerability that allows an attacker to execute arbitrary commands on a system by injecting them into a vulnerable application.
The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary commands on the system, potentially leading to Remote Code Execution and complete compromise of the affected system.
No, at the time of this report, no fix has been released for this vulnerability in node-wifi.
To protect your system, it is recommended to switch to an alternative package that is not vulnerable to this command injection issue.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
