CVE-2018-3786

CRITICAL9.8EPSS 10.0%

Command Injection in egg-scripts

Published: 9/17/2018Modified: 11/8/2023

Description

Versions of `egg-scripts` before 2.8.1 are vulnerable to command injection. This is only exploitable if a malicious argument is provided on the command line. Example: `eggctl start --daemon --stderr='/tmp/eggctl_stderr.log; touch /tmp/malicious'` ## Recommendation Update to version 2.8.1 or later.

Affected packages (1)

npm/egg-scriptsfrom 0, < 2.8.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (7)

ADVISORYhttps://github.com/advisories/GHSA-c9j3-wqph-5xx9
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2018-3786
WEBhttps://github.com/eggjs/egg-scripts/blob/2.8.1/History.md
WEBhttps://github.com/eggjs/egg-scripts/commit/b98fd03d1e3aaed68004b881f0b3d42fe47341dd
WEBhttps://github.com/eggjs/egg-scripts/pull/26
WEBhttps://hackerone.com/reports/388936
WEBhttps://www.npmjs.com/advisories/694