CVE-2020-7602

Summary

CVE	CVE-2020-7602
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2020-03-15 22:15:00 UTC
Updated	2021-07-21 11:39:00 UTC
Description	node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" function in file "linux/manager.js", which is required by the "index. process.env.NM_CLI" in the file "linux/manager.js". This function is used to construct the argument of function "execSync()", which can be controlled by users without any sanitization.

Risk And Classification

Problem Types: CWE-78

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Node-prompt-here Project	Node-prompt-here	All	All	All	All

References

Reference	Source	Link	Tags
Command Injection in node-prompt-here \| Snyk	MISC	snyk.io	Exploit, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

981912 Nodejs (npm) Security Update for node-prompt-here (GHSA-f8fh-8rgm-227h)