CVE-2017-16100

Description

dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/skoranga/node-dns-sync/issues/5 ↗
• https://nodesecurity.io/advisories/523 ↗