VULNERABILITY INTELLIGENCE

CVE-2020-7614

CVSS score9.8 CRITICAL

EPSS probability3.60%

CISA KEVNot currently listed

Published2020-04-07

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are used by the 'exec' function directly.

Weakness classification

CWE-20: Improper Input Validation
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Primary references

report@snyk.io — Patch, Third Party Advisory
report@snyk.io — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory