Homepage
About Snyk

@ronomon/opened@1.4.1 vulnerabilities

Check if a file is open in another application on Windows, macOS and Linux.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the @ronomon/opened package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • C
Arbitrary Command Injection

@ronomon/opened is a Check if a file is open in another application on Windows, macOS and Linux.

Affected versions of this package are vulnerable to Arbitrary Command Injection. This allows a remote attacker to execute commands on the system if the library was used with untrusted input.

The root cause of the problem is line 87 in index.js, which takes potential untrusted input as part of a string executed as a command by child_process.exec(). While the arguments are escaped by, an attacker could still bypass this sanitization because child_process.exec() will also interpret the string as a shell command.

How to fix Arbitrary Command Injection?

Upgrade @ronomon/opened to version 1.5.2 or higher.

<1.5.2
Go back to all versions of this package