CVE-2019-10783 - All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection

Back Back to CVE browser

HIGH

All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection

Published Jan 29, 2020

9.8

HIGH

CVSS 3.1

EPSS 2.64%

Description

All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input.

Affected products

Vendor n/a Product Lsof Default
n/a
- Version
  All versions
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Lsof

n/a

Version	Status	Constraints
All versions	affected	-

Ecosystem	Package	Introduced	Fixed
npm	lsof	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (3)

https://github.com/advisories/GHSA-whq6-mj2r-mjqc
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10783
https://snyk.io/vuln/SNYK-JS-LSOF-543632
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-whq6-mj2r-mjqc		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10783
https://snyk.io/vuln/SNYK-JS-LSOF-543632		x_refsource_MISCExploitThird Party Advisory