Vulnerability · Published Mar 15, 2020 · Assigned by snyk
CVE-2020-7603
Critical 9.8
In plain English
A critical-severity security flaw in closure-compiler-stream. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.6%top 14.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | closure-compiler-stream | no fix listed | GHSA-m647-5wf9-3jp3 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | closure-compiler-stream | All versions including 0.1.15 |
References
- https://snyk.io/vuln/SNYK-JS-CLOSURECOMPILERSTREAM-560123 x_refsource_MISC