Skip to main content

Improper Input Validation

CVE-2020-7614

High
9.8/10

Summary

The npm-programmatic is vulnerable to Command Injection. The packages and option properties are concatenated together without any validation and are used by the 'exec' function directly.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-20 - Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

Advisory Timeline

  • Published