mt7688-wiscan is vulnerable to Command Injection due to improper input sanitization

HIGH 7.8CVE-2022-25916 · GHSA-5h8c-8ccp-8gmh · Published 01/02/2023 · updated 17/06/2026

In short

CVE-2022-25916 is a HIGH (CVSS 7.8) vulnerability affecting mt7688-wiscan (mt7688-wiscan project), mt7688-wiscan.
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 65.9% of all vulnerabilities.
Fix: update to 0.8.3 or later.

Package	Affected versions	Patched versions
mt7688-wiscan mt7688-wiscan_project	`< 0.8.3`	`0.8.3`
mt7688-wiscan npm	`< 0.8.3`	`0.8.3`

Description

Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function.

NVD description

Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function.

References

nvd.nist.gov/vuln/detail/CVE-2022-25916 · ADVISORY
simenkid/mt7688-wiscan commit ff6d656 · WEB
simenkid/mt7688-wiscan · PACKAGE
simenkid/mt7688-wiscan · WEB
security.snyk.io/vuln/SNYK-JS-MT7688WISCAN-3177394 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free