Pedroetb TTS-API OS Command Injection

Description

A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app.js. The manipulation leads to os command injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as 29d9c25415911ea2f8b6de247cb5c4607d13d434.

Recommendation

Update the tts-api package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.2.0
• Patched version(s): 2.2.0

References

• GHSA-jx6q-fq9h-6g7q
• vuldb.com
• CVE-2019-25158
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Prototype Pollution in jquery-deparam - CVE-2021-20087
• files.photo.gallery command injection - CVE-2024-53615
• Potential XSS vulnerability in jQuery - CVE-2020-11023
• mapshaper Path Traversal vulnerability - CVE-2024-1163

Tags:

npm

tts-api