CVE-2020-11079CWE-94

command injection fix in node-dns-sync

High · published May 28, 2020

CVSS v3.1
8.6
EPSS
3%
Percentile
85.7
In the wild
Unconfirmed
What it is

node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.02685 · 85.7th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2020-05-28T18:40Z
EPSS history
Timeline
  • 28 MAY 18:40Z
    command injection fix in node-dns-sync
    cvelistv5