Vulnerability · Published Aug 17, 2021 · Assigned by GitHub_M

CVE-2021-32830

Low 3.9

In plain English

A low-severity OS command injection in diez from diez. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).

Severity (CVSS 3.1)3.9Low

Exploit odds (30 days)1.9%top 20.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The @diez/generation npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. Clients of the @diez/generation library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. All versions of this package are vulnerable as of the writing of this CVE.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@diez/generation	no fix listed	GHSA-8c3f-x5f9-6h62

Affected products (as reported)

Vendor	Product	Versions
diez	diez	all

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://securitylab.github.com/advisories/GHSL-2021-061-diez-generation-cmd-injection/ x_refsource_CONFIRM
https://github.com/diez/diez x_refsource_MISC
https://www.npmjs.com/package/%40diez/generation x_refsource_MISC