Injection in op-browser

Description

op-browser through 1.0.9 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.9

References

• GHSA-3hq6-rmv7-39vh
• snyk.io
• CVE-2020-7625
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Lobe Chat API Key Leak - CVE-2024-37895
• Open redirect in karma - CVE-2021-23495
• Risk of code injection - CVE-2021-21278
• Denial of Service in ws - Vulnerability

Tags:

npm

op-browser