Skip to content
Fencer Intel
critical —

GHSA-28xh-wpgr-7fm8 json

Command Injection in open

published 7y ago modified 6y ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

Versions of `open` before 6.0.0 are vulnerable to command injection when unsanitized user input is passed in.

The package does come with the following warning in the readme:

``` The same care should be taken when calling open as if you were calling child_process.exec directly. If it is an executable it will run in a new shell. ```

## Recommendation

`open` is now the deprecated `opn` package. Upgrading to the latest version is likely have unwanted effects since it now has a very different API but will prevent this vulnerability.

Patch / fix

  • npm open 6.0.0

Is GHSA-28xh-wpgr-7fm8 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
npm open
<6.0.0
6.0.0

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.