CVE-2019-10791 promise-probe OS command injection vulnerability
Remote attackers can execute arbitrary commands via unsanitized inputs in promise-probe library functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10791?
CVE-2019-10791 is a critical command injection vulnerability in Snyk promise-probe, published on 18 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by users without any sanitization.
Weakness: CWE-78
Which versions are affected by CVE-2019-10791?
2 open source packages ship an affected version, including promise-probe. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
promise-probe npm | All versions | 0.1.10 |
promise-probe npm | All versions | 0.1.10 |
Products include Promise-Probe Project Promise-Probe.
How do I fix CVE-2019-10791?
Upgrade promise-probe to 0.1.10 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-10791 being exploited?
There is no known exploitation of CVE-2019-10791 in the wild and no public exploit code.
Sources
Also known as GHSA-vmqq-7qvx-68qx.