CVE-2019-25158 pedroetb tts-api app.js onSpeechDone os command injection
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2019-25158?
CVE-2019-25158 is a medium-severity vulnerability in pedroetb tts-api, published on 19 Dec 2023.
Official description
A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app.js. The manipulation leads to os command injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as 29d9c25415911ea2f8b6de247cb5c4607d13d434. It is recommended to upgrade the affected component. VDB-248278 is the identifier assigned to this vulnerability.
Weakness: CWE-78
Which versions are affected by CVE-2019-25158?
2 open source packages ship an affected version, including tts-api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tts-api npm | All versions | 2.2.0 |
tts-api npm | All versions | 2.2.0 |
Products include Pedroetb Tts-Api.
How do I fix CVE-2019-25158?
Upgrade tts-api to 2.2.0 or later.
Is CVE-2019-25158 being exploited?
There is no known exploitation of CVE-2019-25158 in the wild and no public exploit code.
Sources
Also known as GHSA-jx6q-fq9h-6g7q.