nemo-appium vulnerable to OS Command Injection

CRITICAL 9.8CVE-2022-21129 · GHSA-c6rx-gxqv-vr5j · Published 31/01/2023 · updated 17/06/2026

In short

CVE-2022-21129 is a CRITICAL (CVSS 9.8) vulnerability affecting nemo-appium (paypal), nemo-appium.
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.3% of all vulnerabilities.
Fix: update to 0.0.9 or later.

Package	Affected versions	Patched versions
nemo-appium paypal	`< 0.0.9`	`0.0.9`
nemo-appium npm	`< 0.0.9`	`0.0.9`

Description

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function.

Note: In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies.

NVD description

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. **Note:** In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies.

References

nvd.nist.gov/vuln/detail/CVE-2022-21129 · ADVISORY
paypal/nemo-appium commit aa271d3 · WEB
paypal/nemo-appium · PACKAGE
paypal/nemo-appium · WEB
security.snyk.io/vuln/SNYK-JS-NEMOAPPIUM-3183747 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free