-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the openssl function in index.js which unsafely concatenates user-provided 'verb' parameter into an exec command. The code sample shows direct interpolation of opts.verb into the command string without validation or sanitization. This allows attackers to inject commands via shell operators (e.g., '| touch exploited.txt'). The advisory explicitly identifies the verb field as the injection vector, and the proof-of-concept demonstrates successful exploitation through this parameter. The use of child_process.exec with unvalidated input is a well-known command injection pattern (CWE-77).
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openssl | npm | <= 2.0.0 |
Ongoing coverage of React2Shell