CVE-2014-9682 dns-sync command injection vulnerability
HighCVSS 10.0
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm dns-sync(npm) | < 0.1.1 | 0.1.1 |
| dns-sync project dns-sync | <= 0.1.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com
- github.com patch
- github.com
- [oss-security] 20141111 CVE Request - dns-sync node module mailing-list