OS Command Injection in node-opencv · CVE-2019-10061 · GitHub Advisory Database · GitHub

OS Command Injection in node-opencv

Critical severity GitHub Reviewed Published Oct 12, 2021 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

opencv (npm)

Affected versions

< 6.1.0

Patched versions

6.1.0

Description

utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.

References

Reviewed Oct 7, 2021

Published to the GitHub Advisory Database Oct 12, 2021

Last updated Jan 9, 2023

Severity

Critical

9.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H