CVE-2020-7782 - Command Injection

Back Back to CVE browser

CRITICAL

Command Injection

Published Feb 8, 2021

9.8

CRITICAL

CVSS 3.1

EPSS 2.47%

Description

This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package.

Affected products

Vendor n/a Product Spritesheet-JS Default
unknown
Affected
- ≥ 0, < unspecified

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Spritesheet-JS	unknown	Affected ≥ 0, < unspecified

Ecosystem	Package	Introduced	Fixed
npm	spritesheet-js	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-78

OS Command Injection

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0741
Advisory
https://github.com/advisories/GHSA-333x-qr3v-g4xx
Advisory
https://github.com/krzysztof-o/spritesheet.js/blob/master/lib/generator.js#23L32
https://github.com/krzysztof-o/spritesheet.js/blob/master/lib/generator.js%23L32
x_refsource_MISCBroken Link
https://nvd.nist.gov/vuln/detail/CVE-2020-7782
https://snyk.io/vuln/SNYK-JS-SPRITESHEETJS-1048333
x_refsource_MISCExploitThird Party Advisory
https://www.npmjs.com/package/spritesheet-js
x_refsource_MISCProductThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0741		Advisory
https://github.com/advisories/GHSA-333x-qr3v-g4xx		Advisory
https://github.com/krzysztof-o/spritesheet.js/blob/master/lib/generator.js#23L32
https://github.com/krzysztof-o/spritesheet.js/blob/master/lib/generator.js%23L32		x_refsource_MISCBroken Link
https://nvd.nist.gov/vuln/detail/CVE-2020-7782
https://snyk.io/vuln/SNYK-JS-SPRITESHEETJS-1048333		x_refsource_MISCExploitThird Party Advisory
https://www.npmjs.com/package/spritesheet-js		x_refsource_MISCProductThird Party Advisory