GHSA-9px9-f7jw-fwhj Command Injection in priest-runner
Attackers can execute arbitrary code via unsanitized POST request parameters passed to spawn in the priest-runner library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-9px9-f7jw-fwhj?
GHSA-9px9-f7jw-fwhj is a command injection vulnerability in priest-runner, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of priest-runner are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to a spawn call, which may allow attackers to execute arbitrary code in the system. The PriestController.prototype.createChild function is vulnerable since the spawn parameters come from a POST request body.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
Which versions are affected by GHSA-9px9-f7jw-fwhj?
2 open source packages ship an affected version, including priest-runner.
| Package | Affected | Fixed in |
|---|---|---|
priest-runner npm | From 0.0.0 | None |
priest-runner npm | From 0.0.0 | None |
How do I fix GHSA-9px9-f7jw-fwhj?
No fix has been published for GHSA-9px9-f7jw-fwhj yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is GHSA-9px9-f7jw-fwhj being exploited?
There is no known exploitation of GHSA-9px9-f7jw-fwhj in the wild and no public exploit code.