Potential Command Injection in printer

CRITIQUE 9.8CVE-2014-3741 · GHSA-5c8j-xr24-2665 · Published 23/10/2017 · updated 17/06/2026

En bref

CVE-2014-3741 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant node-printer (node-printer project), printer.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 3.8%, plus élevée que 90.0% des vulnérabilités.
Correctif : mettre à jour vers 0.0.2 ou plus récent.

Package	Affected versions	Patched versions
node-printer node-printer_project	`≤ 0.0.1`	No fix yet
printer npm	`< 0.0.2`	`0.0.2`

Description

Versions 0.0.1 and earlier of printer are affected by a command injection vulnerability resulting from a failure to sanitize command arguments properly in the printDirect() function.

Recommendation

Update to version 0.0.2 or later.

NVD description

The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command.

References

nvd.nist.gov/vuln/detail/CVE-2014-3741 · ADVISORY
tojocky/node-printer commit e001e38 · WEB
GitHub Advisory GHSA-5c8j-xr24-2665 · ADVISORY
tojocky/node-printer · PACKAGE
npmjs.com/advisories/27 · WEB
openwall.com/lists/oss-security/2014/05/13/1 · WEB
openwall.com/lists/oss-security/2014/05/15/2 · WEB
nodesecurity.io/advisories/printer_potential_command_injection · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free