Description
Versions of require-node prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the require-node endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body.
Recommendation
Update the require-node package to the latest compatible version. Followings are version details:
Affected version(s): **>= 2.0.0, < 2.0.4 < 1.3.4** Patched version(s): **2.0.4 1.3.4**
References
Could your website be exposed too?
SmartScanner can check your website for Arbitrary Code Execution in require-node and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Vega vulnerable to arbitrary code execution when clicking href links - Vulnerability
- Sandbox Bypass Leading to Arbitrary Code Execution in constantinople - Vulnerability
- Arbitrary Code Execution in handlebars - Vulnerability
- Sandbox Breakout / Arbitrary Code Execution in localeval - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated January 12, 2023