Homepage

promise-probe@0.1.11 vulnerabilities

FFprobe wrapper

  • latest version

    0.1.12

  • first published

    6 years ago

  • latest version published

    3 years ago

  • licenses detected

  • View promise-probe package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the promise-probe package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Command Injection

    promise-probe is a FFprobe wrapper.

    Affected versions of this package are vulnerable to Command Injection via the ffprobe(file) and createMuteOgg(outputFile, options) functions. file,outputFile,options can be controlled by users without any sanitization

    PoC by JHU System Security Lab

    var root = require("promise-probe");

root.ffprobe("& touch JHU");

root.createMuteOgg("123",{seconds:"& touch JHU &"});

root.createMuteOgg("& touch JHU",{});

    How to fix Command Injection?

    Upgrade promise-probe to version 0.10.0 or higher.

    <0.10.0
    Go back to all versions of this package