CVE-2020-7631 - diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument

CRITICAL

diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument

Published Apr 6, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 3.86%

diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument.

Vendor n/a Product Diskusage-NG Default
unknown
Affected
- All versions including 0.2.4

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Diskusage-NG	unknown	Affected All versions including 0.2.4

Ecosystem	Package	Introduced	Fixed
npm	diskusage-ng	0	not fixed

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0430		Advisory
https://github.com/advisories/GHSA-3269-x4pw-vffg		Advisory
https://github.com/iximiuz/node-diskusage-ng/blob/master/lib/posix.js#L11		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7631
https://snyk.io/vuln/SNYK-JS-DISKUSAGENG-564425		x_refsource_MISCExploit