| शीर्षक | Node.js @syncfusion/ej2-base 33.2.3 OS Command Injection |
|---|
| विवरण | @syncfusion/ej2-base publishes the syncfusion-license CLI:
syncfusion-license
The syncfusion-license validate command reads dependency names and versions from the current project's package.json. For Syncfusion package entries, it builds an npm view command by string concatenation and executes it with child_process.exec().
Because the package name is read from package.json and is not shell-escaped before being concatenated into the command string, shell metacharacters in a dependency name can execute arbitrary commands.
This is reachable through the public CLI and does not require importing internal files. |
|---|
| स्रोत | ⚠️ https://github.com/syncfusion/ej2-javascript-ui-controls/issues/215 |
|---|
| उपयोगकर्ता | wjm2 (UID 99050) |
|---|
| सबमिशन | 16/06/2026 07:31 PM (1 महीना पहले) |
|---|
| संयम | 22/07/2026 06:04 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 382380 [syncfusion ej2-javascript-ui-controls तक 33.2.3 package.json child_process.exec अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|