Vulnerabilities

1 via 1 paths

Dependencies

39

Source

GitHub

Commit

33150a00

Find, fix and prevent vulnerabilities in your code.

Severity
  • 1
Status
  • 1
  • 0
  • 0

high severity
new

Command Injection

  • Vulnerable module: glob
  • Introduced through: glob@11.0.3

Detailed paths

  • Introduced through: node-pg-migrate@salsita/node-pg-migrate#33150a0030954f851eefc75011f05ea1948843ea glob@11.0.3
    Remediation: Upgrade to glob@11.1.0.

Overview

Affected versions of this package are vulnerable to Command Injection in the CLI, via the -c/--cmd option. The processing of commandline options in src/bin.mts calls the foregroundChild() on them, which defaults to setting shell: true. An attacker who can control the filenames being matched can execute arbitrary commands with the privileges of the user running the process by writing files with malicious names containing shell metacharacters - e.g. $(touch injected_poc).

The malicious filename must be the target of a match by the glob -c command. Such filenames would not trigger this exploit when invoking glob() or related functions via the library API.

Remediation

Upgrade glob to version 10.5.0, 11.1.0 or higher.

References