OS Command Injection in strong-nginx-controller

KRITISCH 9.8CVE-2020-7621 · GHSA-4v9w-pvwr-38h3 · SNYK-JS-STRONGNGINXCONTROLLER-564248 · Published 02/04/2020 · updated 17/06/2026

Kurz gesagt

CVE-2020-7621 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in strongloop nginx controller (ibm), strong-nginx-controller.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 3.0%, höher als bei 87.5% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
strongloop nginx controller ibm	`≤ 1.0.2`	No fix yet
strong-nginx-controller npm	`≤ 1.0.2`	No fix yet

Description

strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmd()' function.

NVD description

strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmd()' function.

References

nvd.nist.gov/vuln/detail/CVE-2020-7621 · ADVISORY
strongloop/strong-nginx-controller · WEB
snyk.io/vuln/SNYK-JS-STRONGNGINXCONTROLLER-564248 · WEB
strongloop/strong-nginx-controller

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free