CVE-2019-10061 - utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection

Back Back to CVE browser

CRITICAL

utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection

Published Mar 26, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 4.24%

Description

utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.

Affected products

Ecosystem	Package	Introduced	Fixed
npm	opencv	0	6.1.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (6)

https://github.com/advisories/GHSA-mc7w-4cjf-c973
Advisory
https://github.com/peterbraden/node-opencv/commit/81a4b8620188e89f7e4fc985f3c89b58d4bcc86b
x_refsource_MISCPatchThird Party Advisory
https://github.com/peterbraden/node-opencv/commit/aaece6921d7368577511f06c94c99dd4e9653563
x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10061
https://www.npmjs.com/advisories/789
x_refsource_MISCThird Party Advisory
https://www.npmjs.com/package/opencv

Link	Providers	Tags
https://github.com/advisories/GHSA-mc7w-4cjf-c973		Advisory
https://github.com/peterbraden/node-opencv/commit/81a4b8620188e89f7e4fc985f3c89b58d4bcc86b		x_refsource_MISCPatchThird Party Advisory
https://github.com/peterbraden/node-opencv/commit/aaece6921d7368577511f06c94c99dd4e9653563		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10061
https://www.npmjs.com/advisories/789		x_refsource_MISCThird Party Advisory
https://www.npmjs.com/package/opencv