Vulnerability · Published Jun 1, 2022 · Assigned by mitre
CVE-2021-34082
Critical 9.8
In plain English
A critical-severity security flaw in the proctree package (npm). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.8% (higher than 92% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)4.8%top 8.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to execute arbitrary commands via the fix function.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | proctree | no fix listed | GHSA-cv76-rv4h-4mqc |
Affected products (as reported)
References
- https://advisory.checkmarx.net/advisory/CX-2021-4783 x_refsource_MISC
- https://github.com/allenhwkim/proctree/blob/master/index.js#L46 x_refsource_MISC