Cx435a6fda-ca38 @ Npm-commander-2.1.0

[Svetlana-github]

Vulnerable Package issue exists @ Npm-commander-2.1.0 in branch main

A local code/OS command execution vulnerability was discovered in Commander.js, in the “parse()” method. Given a permission to write and set permissions on a file in the same working directory as the application, and given the ability to pass the value “proto” to the “parse()” method, an attacker can bypass checks against values set in _execs[] to execute an external file which was not intended.

Namespace: Svetlana-github
Repository: test
Repository Url: https://github.com/Svetlana-github/test
CxAST-Project: Svetlana-github/test
CxAST platform scan: 8821ba41-d324-41fa-8053-d13dfc156a43
Branch: main
Application: test
Severity: MEDIUM
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-1321

---

Addition Info
Attack vector: LOCAL
Attack complexity: HIGH
Confidentiality impact: LOW
Availability impact: LOW
Remediation Upgrade Recommendation: 2.20.1

---

References
Release Note
Pull request
Commit
Advisory