Cx435a6fda-ca38 @ Npm-commander-2.9.0

[cyber-sast]

Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about Cx435a6fda-ca38
Applications: Visão Geral
Checkmarx Project: takenet/blip-ds
Repository URL: https://github.com/takenet/blip-ds
Branch: master
Scan ID: 6f0d76c7-ef9a-4ef2-94dc-ca624d6b1227

---

A local code/OS command execution vulnerability was discovered in Commander.js, in the “parse()” method. Given a permission to write and set permissions on a file in the same working directory as the application, and given the ability to pass the value “proto” to the “parse()” method, an attacker can bypass checks against values set in _execs[] to execute an external file which was not intended.

---

Additional Info
Attack vector: LOCAL
Attack complexity: HIGH
Confidentiality impact: LOW
Availability impact: LOW
Remediation Upgrade Recommendation: 2.20.1