CVE-2021-23352 Command Injection
Attackers can execute arbitrary commands by manipulating the Graphviz path option in the madge library, requiring specific function calls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23352?
CVE-2021-23352 is a high-severity command injection vulnerability in madge, published on 9 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.
Weakness: CWE-89
Which versions are affected by CVE-2021-23352?
2 open source packages ship an affected version, including madge. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
madge npm | All versions | 4.0.1 |
madge npm | All versions | 4.0.1 |
Products include Madge Project Madge.
How do I fix CVE-2021-23352?
Upgrade madge to 4.0.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-23352 being exploited?
There is no known exploitation of CVE-2021-23352 in the wild and no public exploit code.
Sources
Also known as GHSA-753c-phhg-cj29, SNYK-JS-MADGE-1082875.