Homepage
About Snyk

rpi@0.0.1 vulnerabilities

Raspberry Pi GPIO communication on top of WiringPi

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the rpi package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Command Injection

rpi is a Node.js library to use the Raspberry Pi GPIOs.

Affected versions of this package are vulnerable to Command Injection. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization.

PoC by JHU System Security Lab

var RPI = require("rpi");
var pin = new RPI.GPIO(';touch vulnerable.txt;', '123');

How to fix Command Injection?

There is no fixed version for rpi.

*
Go back to all versions of this package