Command Injection in wiki-plugin-datalog
Summary
GHSA-pm52-wwrw-c282: Command Injection in wiki-plugin-datalog. Affects wiki-plugin-datalog versions < 0.1.6. Fixed in 0.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wiki-plugin-datalog package is an npm package used for data logging in wiki applications. It provides functionality to store and retrieve data from a database. The package is widely used in various applications and is an integral part of many wiki systems. However, versions prior to 0.1.6 are vulnerable to a Command Injection vulnerability.
Vulnerability Detail
The Command Injection vulnerability in wiki-plugin-datalog arises from the package's failure to properly sanitize URLs on the curl endpoint. This allows attackers to inject arbitrary commands into the system, potentially leading to Remote Code Execution. An attacker can exploit this vulnerability by crafting a malicious URL and sending it to the affected system. If successful, the attacker can execute arbitrary commands with the privileges of the application, compromising the system's integrity and confidentiality.
How To Fix
Latest published version: 0.1.10 as of 22 Oct 2026
npm install wiki-plugin-datalog@0.1.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.6
This is the first release that contains the fix.
npm install wiki-plugin-datalog@0.1.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The wiki-plugin-datalog package prior to version 0.1.6 is vulnerable to Command Injection, which can lead to Remote Code Execution. It is crucial to upgrade to the latest version of the package to mitigate the risk. For further assistance and guidance on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for wiki-plugin-datalog →
FAQ
The vulnerability allows attackers to execute arbitrary commands on the system, potentially leading to Remote Code Execution. This can result in unauthorized access, data breaches, and compromise of the affected system's integrity and confidentiality.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using package-lock.json to detect vulnerabilities without requiring access to the code or installation.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the latest version of the wiki-plugin-datalog package to mitigate the risk.
Yes, the CVSS score for this vulnerability is 6.5, indicating a medium severity level.
For more information about this vulnerability, you can contact info@devnack.com. They can provide further support and guidance on vulnerability remediation.
