← CVE Intelligence

CVE-2018-3772

https://github.com/vvo / whereis PUBLISHED

Description (CNA)

Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` module is deprecated and it is recommended to use the `which` npm module instead.

Affected (CNA)

Vendor / productVersions
https://github.com/vvo / whereisaffected >= 0.4.1

CWE

CWE-77

References

ADP enrichment

CVE

No English description supplied.