Command injection in node-dns-sync

KRITISCH 9.8CVE-2020-11079 · GHSA-wh69-wc6q-7888 · Published 28/05/2020 · updated 17/06/2026

Kurz gesagt

CVE-2020-11079 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in node-dns-sync (node-dns-sync project), dns-sync.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.7%, höher als bei 85.9% aller Schwachstellen.
Abhilfe: auf 0.2.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
node-dns-sync node-dns-sync_project	`< 0.2.1`	`0.2.1`
dns-sync npm	`≥ 0.1.3, < 0.2.1`	`0.2.1`

Description

dns-sync through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

NVD description

node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.

References

skoranga/node-dns-sync security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2020-11079 · ADVISORY
skoranga/node-dns-sync commit cb10a5a · WEB
skoranga/node-dns-sync · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free