CVE-2022-25171

Command Injection

The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization

Affected

p4

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 SNYK

7.4 HIGHCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

2.49% chance of exploitation in the next 30 days, 84th percentile

Published

2022-12-21

Updated

2025-04-16

Proof-of-concept exploits (1)

• https://security.snyk.io/vuln/SNYK-JS-P4-3167330

Security advisories

• natelong/p4/blob/master/p4.js%23L12
• advisories/GHSA-jfm8-hwhg-r6gg

References

• CVE Record
• NVD entry