Description

All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string.

Remediation

References

https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L115

https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L64

https://security.snyk.io/vuln/SNYK-JS-SKETCHSVG-3167969

Related Vulnerabilities

CVE-2021-21290 Vulnerability in maven package io.netty:netty-transport

CVE-2019-10750 Vulnerability in npm package deeply

CVE-2020-13943 Vulnerability in maven package org.apache.tomcat:tomcat-coyote

CVE-2022-36076 Vulnerability in npm package nodebb

CVE-2017-1000043 Vulnerability in npm package mapbox.js

Severity

High

Classification

CWE-94 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Broken Link Exploit Third Party Advisory