GHSA-pm52-wwrw-c282 Command Injection in wiki-plugin-datalog
Attackers can inject commands via unsanitized URLs in the curl endpoint, potentially achieving remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-pm52-wwrw-c282?
GHSA-pm52-wwrw-c282 is a command injection vulnerability in wiki-plugin-datalog, published on 13 Jun 2019. It can be exploited over the network, with no action from the victim.
Official description
Versions of wiki-plugin-datalog prior to 0.1.6 are vulnerable to Command Injection. The package failed to sanitize URLs on the curl endpoint, allowing attackers to inject commands and possibly achieving Remote Code Execution on the system.
Recommendation
Upgrade to version 0.1.6 or later.
Which versions are affected by GHSA-pm52-wwrw-c282?
2 open source packages ship an affected version, including wiki-plugin-datalog.
| Package | Affected | Fixed in |
|---|---|---|
wiki-plugin-datalog npm | All versions | 0.1.6 |
wiki-plugin-datalog npm | All versions | 0.1.6 |
How do I fix GHSA-pm52-wwrw-c282?
Upgrade wiki-plugin-datalog to 0.1.6 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is GHSA-pm52-wwrw-c282 being exploited?
There is no known exploitation of GHSA-pm52-wwrw-c282 in the wild and no public exploit code.