GHSA-xhjx-mfr6-9rr4 Command Injection in samsung-remote
Attackers can execute arbitrary commands if user input is passed to the IP option in the samsung-remote library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-xhjx-mfr6-9rr4?
GHSA-xhjx-mfr6-9rr4 is a command injection vulnerability in samsung-remote, published on 1 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Versions of samsung-remote before 1.3.5 are vulnerable to command injection. This vulnerability is exploitable if user input is passed into the ip option of the package constructor.
Recommendation
Update to version 1.3.5 or later.
Which versions are affected by GHSA-xhjx-mfr6-9rr4?
2 open source packages ship an affected version, including samsung-remote.
| Package | Affected | Fixed in |
|---|---|---|
samsung-remote npm | All versions | 1.3.5 |
samsung-remote npm | All versions | 1.3.5 |
How do I fix GHSA-xhjx-mfr6-9rr4?
Upgrade samsung-remote to 1.3.5 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is GHSA-xhjx-mfr6-9rr4 being exploited?
There is no known exploitation of GHSA-xhjx-mfr6-9rr4 in the wild and no public exploit code.