Command Injection The advisory has been revoked - it doesn't affect any version of package theme-core  (opens in a new tab)


Threat Intelligence

Exploit Maturity
Not Defined
EPSS
0.24% (64th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Command Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JS-THEMECORE-1050425
  • published23 Feb 2021
  • disclosed11 Dec 2020
  • creditJHU System Security Lab

Introduced: 11 Dec 2020

CVE-2020-28432  (opens in a new tab)
CWE-78  (opens in a new tab)
First added by Snyk

How to fix?

There is no fixed version for theme-core.

Amendment

This was deemed not a vulnerability.

Overview

Affected versions of this package are vulnerable to Command Injection via the lib/utils.js file, which is required by main entry of the package.

Note: CVE-2020-28432 has been retracted because it was found to be invalid. Further investigation showed that it was not a security issue.

PoC

var a =require("theme-core");
a.utils.sh("touch JHU")