Injection in op-browser

Description

op-browser through 1.0.9 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.9

References

• GHSA-3hq6-rmv7-39vh
• snyk.io
• CVE-2020-7625
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Code injection in electerm - CVE-2020-23256
• Code Injection in mquery - CVE-2020-35149
• OS Command Injection in systeminformation - CVE-2020-7778
• Code Injection in node-rules - CVE-2020-7609

Tags:

npm

op-browser