Description (CNA)
promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by users without any sanitization.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Snyk / promise-probe | affected All versions prior to version 0.10.0 |
CWE
No CWE identifiers supplied.
References
- https://github.com/dottgonzo/node-promise-probe/commit/0d9affb67fc1ad985903536d35372cf55efe5a45%2C
- https://snyk.io/vuln/SNYK-JS-PROMISEPROBE-546816
ADP enrichment
No English description supplied.