Description
better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a semicolon, pipe, or command substitution executes arbitrary operating system commands with the privileges of the process running the audit.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
jeemok better-npm-audit
Default version status: unaffected
0 to ≤ 3.11.0affected4.0.0-rc.2affected
pkg:npm/better-npm-auditReferences
- https://github.com/jeemok/better-npm-audit/issues/119 ↗
- https://github.com/jeemok/better-npm-audit ↗
- https://github.com/jeemok/better-npm-audit/blob/fd99a0f41ff4342b8a0a6fdbe5a17261de3d0544/src/handlers/handleInput.ts#L30-L37 ↗
- https://github.com/jeemok/better-npm-audit/blob/fd99a0f41ff4342b8a0a6fdbe5a17261de3d0544/index.ts#L34 ↗
- https://github.com/jeemok/better-npm-audit/pull/120 ↗
- https://www.vulncheck.com/advisories/better-npm-audit-os-command-injection-via-registry-flag ↗