nemo-appium vulnerable to OS Command Injection

KRITISCH 9.8CVE-2022-21129 · GHSA-c6rx-gxqv-vr5j · Published 31/01/2023 · updated 17/06/2026

Kurz gesagt

CVE-2022-21129 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in nemo-appium (paypal), nemo-appium.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.8%, höher als bei 86.3% aller Schwachstellen.
Abhilfe: auf 0.0.9 oder neuer aktualisieren.

Package	Affected versions	Patched versions
nemo-appium paypal	`< 0.0.9`	`0.0.9`
nemo-appium npm	`< 0.0.9`	`0.0.9`

Description

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function.

Note: In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies.

NVD description

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. **Note:** In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies.

References

nvd.nist.gov/vuln/detail/CVE-2022-21129 · ADVISORY
paypal/nemo-appium commit aa271d3 · WEB
paypal/nemo-appium · PACKAGE
paypal/nemo-appium · WEB
security.snyk.io/vuln/SNYK-JS-NEMOAPPIUM-3183747 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free