CVE-2021-23352

Command Injection

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.

Affected

madge

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 SNYK

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.06% chance of exploitation in the next 30 days, 81st percentile

Published

2021-03-09

Updated

2024-09-16

Proof-of-concept exploits (1)

• https://snyk.io/vuln/SNYK-JS-MADGE-1082875

Security advisories

• pahen/madge/blob/master/lib/graph.js%23L27
• advisories/GHSA-753c-phhg-cj29

References

• CVE Record
• NVD entry