Cx435a6fda-ca38 @ Npm-commander-2.5.1

[CMaheshBL]

Vulnerable Package issue exists @ Npm-commander-2.5.1 in branch master

A local code/OS command execution vulnerability was discovered in Commander.js, in the “parse()” method. Given a permission to write and set permissions on a file in the same working directory as the application, and given the ability to pass the value “proto” to the “parse()” method, an attacker can bypass checks against values set in _execs[] to execute an external file which was not intended.

Namespace: CMaheshBL
Repository: NodeGoat
Repository Url: https://github.com/CMaheshBL/NodeGoat
CxAST-Project: CMaheshBL/NodeGoat
CxAST platform scan: d7c1c0af-6b2d-455e-8753-a6b87dbf733d
Branch: master
Application: NodeGoat
Severity: MEDIUM
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-1321

---

Addition Info
Attack vector: LOCAL
Attack complexity: HIGH
Confidentiality impact: LOW
Availability impact: LOW
Remediation Upgrade Recommendation: 2.20.1

---

References
Release Note
Pull request
Commit
Advisory