Vulnerability · Published Mar 4, 2021 · Assigned by hackerone

CVE-2020-8298

Critical 9.8

In plain English

A critical-severity command injection in fs-path. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.2% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)11.2%top 4.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, and `removeSync` methods.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	fs-path	0.0.25	GHSA-8mrf-64fw-2x75

Affected products (as reported)

Vendor	Product	Versions
n/a	fs-path	Fixed in 0.0.25

Weakness: CWE-77

References

https://hackerone.com/reports/324491 x_refsource_MISC
https://github.com/pillys/fs-path/pull/6 x_refsource_MISC
https://github.com/pillys/fs-path/commit/88ff5ee51046bb2c5d5e9c5afe6819b032092ce7 x_refsource_MISC