CVE-2020-7620 - pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params

CRITICAL

pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params

Published Apr 2, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 2.17%

pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Pomelo-Monitor

n/a

Version	Status	Constraints
All versions including 0.3.7	affected	-

Ecosystem	Package	Introduced	Fixed
npm	pomelo-monitor	0	not fixed

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

Link	Providers	Tags
https://github.com/advisories/GHSA-4j54-mxf6-wxx2		Advisory
https://github.com/halfblood369/monitor/blob/900b5cadf59edcccac4754e5706a22719925ddb9/lib/processMonitor.js%2C		x_refsource_MISC
https://github.com/halfblood369/monitor/blob/900b5cadf59edcccac4754e5706a22719925ddb9/lib/processMonitor.js,
https://nvd.nist.gov/vuln/detail/CVE-2020-7620
https://snyk.io/vuln/SNYK-JS-POMELOMONITOR-173695		x_refsource_MISCThird Party Advisory