Description

All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function.

Remediation

References

https://security.snyk.io/vuln/SNYK-JS-ISHTTP2-3153878

https://github.com/stefanjudis/is-http2/blob/master/index.js%23L23

Related Vulnerabilities

CVE-2021-23558 Vulnerability in npm package bmoor

CVE-2022-0144 Vulnerability in npm package shelljs

CVE-2020-28503 Vulnerability in npm package copy-props

CVE-2020-29204 Vulnerability in maven package com.xuxueli:xxl-job-admin

CVE-2021-32738 Vulnerability in npm package stellar-sdk

Severity

High

Classification

CWE-78 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Broken Link