CVE-2014-9682

Description

The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.

How to fix CVE-2014-9682

To remediate CVE-2014-9682, upgrade the affected package to a fixed version below.

• npm/dns-sync—upgrade to 0.1.1 or later

Is CVE-2014-9682 being exploited?

Low — EPSS is 2.9%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 0.1.1

References (6)

• ADVISORYgithub.com/advisories/GHSA-q5pq-pgrv-fh89
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-9682
• PATCHgithub.com/skoranga/node-dns-sync
• WEBwww.openwall.com/lists/oss-security/2014/11/11/6
• WEB