CVE-2023-26107

2023-03-0605:15:12

CWE-94

snyk

web.nvd.nist.gov

cve-2023-26107

sketchsvg

arbitrary code injection

nvd

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string.

Affected configurations

Nvd

Node

ebaysketchsvgMatch-

VendorProductVersionCPE
ebaysketchsvg-cpe:2.3:a:ebay:sketchsvg:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ebay	sketchsvg	-	cpe:2.3:a:ebay:sketchsvg:-:::::::*

CNA Affected

[
  {
    "product": "sketchsvg",
    "versions": [
      {
        "version": "0",
        "lessThan": "*",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]