Injection in op-browser

Description

op-browser through 1.0.9 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.9

References

• GHSA-3hq6-rmv7-39vh
• snyk.io
• CVE-2020-7625
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Injection and Command Injection in devcert - CVE-2020-8186
• DLL Injection in kerberos - CVE-2020-13110
• Code Injection in mquery - CVE-2020-35149
• xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection - CVE-2020-28502

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

op-browser