Cx435a6fda-ca38 @ Npm-commander-2.3.0

[RobertMickleCx]

Vulnerable Package issue exists @ Npm-commander-2.3.0 in branch master

A local code/OS command execution vulnerability was discovered in Commander.js, in the “parse()” method. Given a permission to write and set permissions on a file in the same working directory as the application, and given the ability to pass the value “proto” to the “parse()” method, an attacker can bypass checks against values set in _execs[] to execute an external file which was not intended.

Namespace: RobertMickleCx
Repository: NodeGoat
Repository Url: https://github.com/RobertMickleCx/NodeGoat
CxAST-Project: RobertMickleCx/NodeGoat
CxAST platform scan: 4cad0b9d-cbe1-4acd-bb82-244764df9dbd
Branch: master
Application: NodeGoat
Severity: MEDIUM
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-1321

---

Additional Info
Attack vector: LOCAL
Attack complexity: HIGH
Confidentiality impact: LOW
Availability impact: LOW

---

References
Release Note
Pull request
Commit
Advisory