Command Injection in plotter
Summary
GHSA-65xx-c85x-wg76: Command Injection in plotter. Affects plotter versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The plotter package is an npm package used for creating plots and graphs. It provides a simple interface for generating various types of plots and saving them as files. The package is widely used in applications that require data visualization. However, all versions of plotter are vulnerable to Command Injection.
Vulnerability Detail
The vulnerability in plotter arises from the package's failure to properly sanitize plot titles. This allows attackers to inject arbitrary commands into the system if the title value is supplied by a user. By crafting a malicious title, an attacker can execute arbitrary code on the target system. For example, an attacker can create a file in the current directory using the following proof-of-concept code:
var plot = require('plotter').plot;
const title = 'Example "\nset title system("touch testing")#';
plot({
data: [ 3, 1, 2, 3, 4 ],
filename: 'output.pdf',
style: 'linespoints',
title: title,
logscale: true,
xlabel: 'time',
ylabel: 'length of string',
format: 'pdf'
});
This code creates a file named testing in the current directory.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no fix available, the only workaround is to avoid using the plotter package or to ensure that the plot titles are not supplied by user input. If user input is required for plot titles, it is crucial to properly sanitize and validate the input to prevent command injection.
Conclusion
The plotter package is vulnerable to command injection, allowing attackers to execute arbitrary code on the target system. Currently, there is no fix available, and it is recommended to use an alternative package or ensure proper input sanitization to prevent command injection vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for plotter →
FAQ
This vulnerability allows attackers to execute arbitrary code on the target system. They can potentially gain unauthorized access, modify files, or perform other malicious actions depending on the privileges of the process running the vulnerable code.
Yes, all versions of plotter are vulnerable to this command injection vulnerability.
No, there is currently no fix available for this vulnerability in the plotter package.
It is not recommended to use the plotter package until a fix is made available. Consider using an alternative package that properly sanitizes plot titles.
To prevent command injection vulnerabilities, always sanitize and validate user input before using it in any command or system call. Use proper input validation techniques and avoid executing user-supplied input as commands without proper sanitization.
