CVE-2019-10061

utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.

CVSS v3.0 NVD

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

4.24% chance of exploitation in the next 30 days, 91st percentile

Published

2019-03-26

Updated

2024-08-04

Proof-of-concept exploits (1)

• ossf-cve-benchmark/CVE-2019-100610★ · 2020-12-01

Security advisories

• peterbraden/node-opencv/commit/81a4b8620188e89f7e4fc985f3c89b58d4bcc86b
• https://www.npmjs.com/advisories/789
• advisories/GHSA-mc7w-4cjf-c973

References

• CVE Record
• NVD entry