CVE-2020-7688 Command Injection
Attackers can execute arbitrary commands via unsanitized tagName input in the mversion npm library, potentially compromising the host system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7688?
CVE-2020-7688 is a high-severity command injection vulnerability in mversion, published on 1 Jul 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.
Weakness: CWE-78
Which versions are affected by CVE-2020-7688?
2 open source packages ship an affected version, including mversion. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mversion npm | All versions | 2.0.1 |
mversion npm | All versions | 2.0.1 |
Products include Mversion Project Mversion.
How do I fix CVE-2020-7688?
Upgrade mversion to 2.0.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-7688 being exploited?
There is no known exploitation of CVE-2020-7688 in the wild and no public exploit code.
Other vulnerabilities in mversion
Sources
Also known as GHSA-6m8p-4fxj-pgc2, SNYK-JS-MVERSION-573174.