CVE-2022-29080

Name of the Vulnerable Software and Affected Versions npm-dependency-versions versions 0.3.0 and earlier

Description The issue is related to insufficient argument checking in the npm-dependency-versions package, which can lead to command injection. An attacker can exploit this by calling dependencyVersions with a JSON object containing a pkgs key and shell metacharacters in a value, potentially allowing remote execution of arbitrary commands.

Recommendations For versions 0.3.0 and earlier, consider disabling the dependencyVersions function until a patch is available to prevent command injection attacks. Restrict access to the dependencyVersions function to minimize the risk of exploitation. Avoid using the pkgs key in the JSON object passed to the dependencyVersions function until the issue is resolved.