CVE-2021-23352

Name of the Vulnerable Software and Affected Versions madge versions prior to 4.0.1

Description The issue affects the madge package, allowing an attacker to specify a custom Graphviz path via the graphVizPath option parameter. When the .image(), .svg(), or .dot() functions are called, the specified path is executed by the childprocess.exec function. This could potentially lead to arbitrary command execution.

Recommendations For madge versions prior to 4.0.1, consider disabling the childprocess.exec function or restricting the use of the graphVizPath option parameter until a patch is available. Avoid using the graphVizPath option parameter in the affected API endpoints until the issue is resolved. Update to version 4.0.1 or later to resolve the issue.