Injection in op-browser

Description

op-browser through 1.0.9 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.9

References

• GHSA-3hq6-rmv7-39vh
• snyk.io
• CVE-2020-7625
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Code Injection in cd-messenger - CVE-2020-7675
• Injection and Command Injection in devcert - CVE-2020-8186
• Server-Side Template Injection in formio - CVE-2020-28246
• Code Injection in jsen - CVE-2020-7777

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

op-browser