OS Command Injection in s3-uploader

KRITISCH 9.8CVE-2021-34084 · GHSA-gwp3-f7mr-qpfv · Published 02/06/2022 · updated 17/06/2026

Kurz gesagt

CVE-2021-34084 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in s3-uploader (s3-uploader project), s3-uploader.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 3.1%, höher als bei 87.7% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
s3-uploader s3-uploader_project	`≤ 2.0.3`	No fix yet
s3-uploader npm	`≤ 2.0.3`	No fix yet

Description

OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metadata() function.

NVD description

OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metadata() function.

References

nvd.nist.gov/vuln/detail/CVE-2021-34084 · ADVISORY
advisory.checkmarx.net/advisory/CX-2021-4776 · WEB
Turistforeningen/node-s3-uploader · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free