Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2021-23352

Command Injection

Description

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a madge

  • unspecified to < 4.0.1affected

References