GHSA-w725-67p7-xv22 Command Injection in local-devices
Attackers can execute arbitrary system commands via unvalidated IP addresses in the local-devices npm package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-w725-67p7-xv22?
GHSA-w725-67p7-xv22 is a command injection vulnerability in local-devices, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of local-devices prior to 3.0.0 are vulnerable to Command Injection. The package does not validate input on ip addresses and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.
Recommendation
Upgrade to version 3.0.0 or later.
Which versions are affected by GHSA-w725-67p7-xv22?
2 open source packages ship an affected version, including local-devices.
| Package | Affected | Fixed in |
|---|---|---|
local-devices npm | All versions | 3.0.0 |
local-devices npm | All versions | 3.0.0 |
How do I fix GHSA-w725-67p7-xv22?
Upgrade local-devices to 3.0.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is GHSA-w725-67p7-xv22 being exploited?
There is no known exploitation of GHSA-w725-67p7-xv22 in the wild and no public exploit code.