Command Injection in priest-runner
Summary
GHSA-9px9-f7jw-fwhj: Command Injection in priest-runner. Affects priest-runner versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
priest-runner is an npm package used for running scripts in a child process. It allows users to execute commands in a separate process and capture the output. The package is commonly used in Node.js applications for task automation and script execution. However, all versions of priest-runner are vulnerable to Command Injection, which can lead to arbitrary code execution on the system.
Vulnerability Detail
The vulnerability in priest-runner arises from a failure to properly sanitize user input before passing it to a spawn call. This allows attackers to inject malicious commands into the system. Specifically, the PriestController.prototype.createChild function is vulnerable as it takes parameters from a POST request body without proper validation. An attacker can exploit this vulnerability to execute arbitrary code with the privileges of the user running the application. This can lead to a complete compromise of the system and unauthorized access to sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no fix available, it is important to take precautionary measures to mitigate the risk. One possible workaround is to implement strict input validation and sanitization in the application code. Ensure that user input is properly validated and sanitized before passing it to any command execution functions. Additionally, consider using a different package that has been audited for security vulnerabilities.
Conclusion
priest-runner is vulnerable to Command Injection, which can lead to arbitrary code execution on the system. Currently, there is no fix available for this vulnerability. It is recommended to consider using an alternative package and implementing strict input validation and sanitization in your application code. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for priest-runner →
FAQ
priest-runner is an npm package used for running scripts in a child process. It is commonly used in Node.js applications for task automation and script execution.
Command Injection is a security vulnerability that allows an attacker to execute arbitrary commands on a system. It occurs when user input is not properly validated or sanitized before being passed to a command execution function.
The vulnerability in priest-runner allows an attacker to execute arbitrary code on the system. This can lead to a complete compromise of the system and unauthorized access to sensitive data.
Currently, there is no fix available for this vulnerability. It is recommended to consider using an alternative package until a fix is made available.
To mitigate the risk, implement strict input validation and sanitization in your application code. Ensure that user input is properly validated and sanitized before passing it to any command execution functions. Consider using a different package that has been audited for security vulnerabilities.
