Vulnerability · Published Jul 25, 2022 · Assigned by snyk

CVE-2020-28445Command Injection

Critical 9.8

In plain English

A critical-severity security flaw in npm-help. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.5%top 25.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() function.

Affected products (as reported)

Vendor	Product	Versions
n/a	npm-help	0 – before unspecified

References

https://security.snyk.io/vuln/SNYK-JS-NPMHELP-1050983 x_refsource_MISC
https://security.netapp.com/advisory/ntap-20220901-0012/ x_refsource_CONFIRM