Command Injection Affecting window-control package, versions <1.4.5
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.05% (17th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-WINDOWCONTROL-3186345
- published 4 Jan 2023
- disclosed 2 Jan 2023
- credit JHU System Security Lab
Introduced: 2 Jan 2023
CVE-2022-25926 Open this link in a new tabHow to fix?
Upgrade window-control to version 1.4.5 or higher.
Overview
window-control is a package aimed to do similar tasks as robot.js (without mouse control) but without the compiling of external C++ code.
Affected versions of this package are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization.
PoC
var root =require("window-control")
root.sendKeys("& touch JHU","")
References
CVSS Scores
version 3.1