Vulnerability · Published Jan 11, 2023 · Assigned by VulDB

CVE-2020-36650IonicaBizau node-gry command injection

Medium 5.5

In plain English

A medium-severity command injection in node-gry from IonicaBizau. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)2.2%top 17.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x. This affects an unknown part. The manipulation leads to command injection. Upgrading to version 6.0.0 is able to address this issue. The patch is named 5108446c1e23960d65e8b973f1d9486f9f9dbd6c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218019.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	gry	6.0.0	GHSA-w5mw-f2hq-5fw8

Affected products (as reported)

Vendor	Product	Versions
IonicaBizau	node-gry	5.x

Weakness: CWE-77 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.218019 vdb-entry, technical-description
https://vuldb.com/?ctiid.218019 signature, permissions-required
https://github.com/IonicaBizau/node-gry/pull/22 issue-tracking
https://github.com/IonicaBizau/node-gry/commit/5108446c1e23960d65e8b973f1d9486f9f9dbd6c patch
https://github.com/IonicaBizau/node-gry/releases/tag/6.0.0 patch