CVE-2021-29369 Code injection in @rkesters/gnuplot
An attacker can execute arbitrary code by injecting shell metacharacters into Gnuplot commands within the Node.js gnuplot library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-29369?
CVE-2021-29369 is a critical command injection vulnerability in n/a, published on 3 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.
Weakness: CWE-78
Which versions are affected by CVE-2021-29369?
2 open source packages ship an affected version, including @rkesters/gnuplot. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@rkesters/gnuplot npm | All versions | 0.1.1 |
@rkesters/gnuplot npm | All versions | 0.1.1 |
Products include Gnuplot Project Gnuplot.
How do I fix CVE-2021-29369?
Upgrade @rkesters/gnuplot to 0.1.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-29369 being exploited?
There is no known exploitation of CVE-2021-29369 in the wild and no public exploit code.
Sources
Also known as GHSA-f2jw-pr2c-9x96.