CVE-2022-21165 - Arbitrary Command Injection

Back Back to CVE browser

CRITICAL

Arbitrary Command Injection

Published Aug 29, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 3.12%

Description

All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child_process.exec() function.

Affected products

Vendor n/a Product Font-Converter Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <unspecified

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Font-Converter

n/a

Version	Status	Constraints
0	affected	<unspecified

Ecosystem	Package	Introduced	Fixed
npm	font-converter	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-77

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6555
Advisory
https://github.com/advisories/GHSA-g2c3-vwff-m3xr
Advisory
https://github.com/zgec/node-js-font-converter/blob/master/index.js#L12
https://github.com/zgec/node-js-font-converter/blob/master/index.js%23L12
x_refsource_MISCBroken LinkThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-21165
https://security.snyk.io/vuln/SNYK-JS-FONTCONVERTER-2976194
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6555		Advisory
https://github.com/advisories/GHSA-g2c3-vwff-m3xr		Advisory
https://github.com/zgec/node-js-font-converter/blob/master/index.js#L12
https://github.com/zgec/node-js-font-converter/blob/master/index.js%23L12		x_refsource_MISCBroken LinkThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-21165
https://security.snyk.io/vuln/SNYK-JS-FONTCONVERTER-2976194		x_refsource_MISCExploitThird Party Advisory