OS Command Injection in s3-uploader

CRITICAL 9.8CVE-2021-34084 · GHSA-gwp3-f7mr-qpfv · Published 02/06/2022 · updated 17/06/2026

In short

CVE-2021-34084 is a CRITICAL (CVSS 9.8) vulnerability affecting s3-uploader (s3-uploader project), s3-uploader.
Chance of exploitation in the next 30 days (EPSS): 3.1%, higher than 87.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
s3-uploader s3-uploader_project	`≤ 2.0.3`	No fix yet
s3-uploader npm	`≤ 2.0.3`	No fix yet

Description

OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metadata() function.

NVD description

OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metadata() function.

References

nvd.nist.gov/vuln/detail/CVE-2021-34084 · ADVISORY
advisory.checkmarx.net/advisory/CX-2021-4776 · WEB
Turistforeningen/node-s3-uploader · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free