Command Injection Affecting npm-lockfile package, versions <2.0.5
Threat Intelligence
EPSS
0.27% (67th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-NPMLOCKFILE-2420034
- published 9 Mar 2022
- disclosed 4 Mar 2022
- credit Feng Xiao
How to fix?
Upgrade npm-lockfile to version 2.0.5 or higher.
Overview
Affected versions of this package are vulnerable to Command Injection which does not sanitize unsafe external input and invoke sensitive command execution API with the input.
References
CVSS Scores
version 3.1