Command injection in node-dns-sync

CRITICAL 9.8CVE-2020-11079 · GHSA-wh69-wc6q-7888 · Published 28/05/2020 · updated 17/06/2026

In short

CVE-2020-11079 is a CRITICAL (CVSS 9.8) vulnerability affecting node-dns-sync (node-dns-sync project), dns-sync.
Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 85.9% of all vulnerabilities.
Fix: update to 0.2.1 or later.

Package	Affected versions	Patched versions
node-dns-sync node-dns-sync_project	`< 0.2.1`	`0.2.1`
dns-sync npm	`≥ 0.1.3, < 0.2.1`	`0.2.1`

Description

dns-sync through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

NVD description

node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.

References

skoranga/node-dns-sync security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2020-11079 · ADVISORY
skoranga/node-dns-sync commit cb10a5a · WEB
skoranga/node-dns-sync · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free