Hidden functionality in node-ipc

published 2022-03-16 4y ago modified 2022-03-16 4y ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

The package node-ipc version 9.2.2 is vulnerable to hidden functionality that was introduced by the maintainer. The package uses a dependency that writes a file to disk that does not pertain to the functionality of the package and is not included in versions < 9.2.2.

Patch / fix

links 1

github.com/RIAEvangelist/node-ipc/releases/tag/9.2.2 release

Is GHSA-8gr3-2gjw-jj7g in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
npm	node-ipc	1 listed version	no fix listed

Classification

Weakness

CWE-912 Hidden Functionality

References

Sources

GitHub Advisory GHSA-8gr3-2gjw-jj7g

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.