org.webjars.npm:open@6.0.0

latest version

10.2.0

first published

7 years ago

latest version published

3 months ago

licenses detected

MIT
[6.0.0,)

package registry

View on Maven Central Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:open package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H Improper Encoding or Escaping of Output org.webjars.npm:open is a cross platform package that opens stuff like URLs, files, executables. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the `baseOpen` function in `index.js`, which assembles a PowerShell `Start-Process` invocation by wrapping each argument as "`"${argument}`"" without escaping a double quote inside the value, and passes the target through with `$` intact so PowerShell expands it as a variable reference. An attacker who controls the target or an entry in `options.app.arguments` can change the command PowerShell receives, either dropping text where a `$name` segment is expanded away or terminating the surrounding quoting with a `"`, which makes the call fail with no error surfaced to the caller. Reaching either case requires the calling application to pass a target or argument value that the attacker influences. Note: This applies only where the PowerShell path is taken, meaning Windows, or WSL, where the target is first converted with `convertWslPathToWindows` and then handed to the same invocation. Callers on other platforms do not reach this assembly. How to fix Improper Encoding or Escaping of Output? A fix was pushed into the `master` branch but not yet published.	[0,)

Improper Encoding or Escaping of Output

org.webjars.npm:open is a cross platform package that opens stuff like URLs, files, executables.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the baseOpen function in index.js, which assembles a PowerShell Start-Process invocation by wrapping each argument as "`"${argument}`"" without escaping a double quote inside the value, and passes the target through with $ intact so PowerShell expands it as a variable reference. An attacker who controls the target or an entry in options.app.arguments can change the command PowerShell receives, either dropping text where a $name segment is expanded away or terminating the surrounding quoting with a ", which makes the call fail with no error surfaced to the caller. Reaching either case requires the calling application to pass a target or argument value that the attacker influences.

Note: This applies only where the PowerShell path is taken, meaning Windows, or WSL, where the target is first converted with convertWslPathToWindows and then handed to the same invocation. Callers on other platforms do not reach this assembly.

How to fix Improper Encoding or Escaping of Output?

A fix was pushed into the master branch but not yet published.

[0,)

Go back to all versions of this package