window-control vulnerable to Command Injection due to improper input sanitization

HOCH 7.8CVE-2022-25926 · GHSA-9mjx-wfqp-j5ph · Published 04/01/2023 · updated 17/06/2026

Kurz gesagt

CVE-2022-25926 ist eine Schwachstelle (HOCH (CVSS 7.8)) in window-control (window-control project), window-control.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.1%, höher als bei 66.1% aller Schwachstellen.
Abhilfe: auf 1.4.5 oder neuer aktualisieren.

Package	Affected versions	Patched versions
window-control window-control_project	`< 1.4.5`	`1.4.5`
window-control npm	`< 1.4.5`	`1.4.5`

Description

window-control is an npm package that provides tools to manage window focus. Versions before 1.4.5 are vulnerable to Command Injection via the sendKeys function due to improper input sanitization.

NVD description

Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization.

References

nvd.nist.gov/vuln/detail/CVE-2022-25926 · ADVISORY
bruno-robert/window-control commit 075c854 · WEB
bruno-robert/window-control · PACKAGE
bruno-robert/window-control release v1.4.5 · WEB
security.snyk.io/vuln/SNYK-JS-WINDOWCONTROL-3186345 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free