global-modules-path Command Injection vulnerability

CRITICAL 9.8CVE-2022-21191 · GHSA-vvj3-85vf-fgmw · Published 13/01/2023 · updated 17/06/2026

In short

CVE-2022-21191 is a CRITICAL (CVSS 9.8) vulnerability affecting global-modules-path (global-modules-path project), global-modules-path.
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 75.1% of all vulnerabilities.
Fix: update to 3.0.0 or later.

Package	Affected versions	Patched versions
global-modules-path global-modules-path_project	`< 3.0.0`	`3.0.0`
global-modules-path npm	`< 3.0.0`	`3.0.0`

Description

Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.

NVD description

Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.

References

nvd.nist.gov/vuln/detail/CVE-2022-21191 · ADVISORY
rosen-vladimirov/global-modules-path commit edbdaff · WEB
lorenzomigliorero/npm-node-utils · WEB
rosen-vladimirov/global-modules-path · PACKAGE
rosen-vladimirov/global-modules-path release v3.0.0 · WEB
security.snyk.io/vuln/SNYK-JS-GLOBALMODULESPATH-3167973 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free