CVE-2017-1000219 - npm/KyleRoss windows-cpu all versions vulnerable to command injection resulting in code execution as Node.js user

CRITICAL

npm/KyleRoss windows-cpu all versions vulnerable to command injection resulting in code execution as Node.js user

Published Nov 17, 2017

9.8

CRITICAL

CVSS 3.0

EPSS 4.24%

npm/KyleRoss windows-cpu all versions vulnerable to command injection resulting in code execution as Node.js user

Ecosystem	Package	Introduced	Fixed
npm	windows-cpu	0	0.1.5

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

Link	Providers	Tags
https://github.com/KyleRoss/windows-cpu/blob/master/index.js#L81
https://github.com/KyleRoss/windows-cpu/commit/b75e19aa2f7459a9506bceb577ba2341fe273117
https://github.com/advisories/GHSA-63m4-fhf2-cmf7		Advisory
https://nodesecurity.io/advisories/336		x_refsource_CONFIRMExploitMitigationThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-1000219
https://www.npmjs.com/advisories/336