Description

Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization.

Remediation

References

https://github.com/bruno-robert/window-control/commit/075c854534a749d887655a906759f5a7eee95173

https://github.com/bruno-robert/window-control/releases/tag/v1.4.5

https://security.snyk.io/vuln/SNYK-JS-WINDOWCONTROL-3186345

Related Vulnerabilities

CVE-2020-28469 Vulnerability in maven package org.webjars.npm:glob-parent

CVE-2020-15366 Vulnerability in maven package org.webjars.bowergithub.ajv-validator:ajv

CVE-2021-23373 Vulnerability in npm package set-deep-prop

CVE-2023-50449 Vulnerability in maven package com.jfinal:jfinal

CVE-2020-28451 Vulnerability in npm package image-tiler

Severity

High

Classification

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory NVD-CWE-Other