Command Injection in apex-publish-static-files

CRITIQUE 10.0CVE-2018-16462 · GHSA-9jm3-5835-537m · Published 30/10/2018 · updated 17/06/2026

En bref

CVE-2018-16462 est une vulnérabilité CRITIQUE (CVSS 10.0) touchant apex-publish-static-files (apex-publish-static-files project), apex-publish-static-files.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 7.0%, plus élevée que 94.2% des vulnérabilités.
Correctif : mettre à jour vers 2.0.1 ou plus récent.

Package	Affected versions	Patched versions
apex-publish-static-files apex-publish-static-files_project	`< 2.0.1`	`2.0.1`
apex-publish-static-files npm	`< 2.0.1`	`2.0.1`

Description

Versions of apex-publish-static-files before 2.0.1 are vulnerable to command injection. This is exploitable if user input is passed into the connectString option in the publish method.

Recommendation

Update to version 2.0.1 or later.

NVD description

A command injection vulnerability in the apex-publish-static-files npm module version <2.0.1 which allows arbitrary shell command execution through a maliciously crafted argument.

References

nvd.nist.gov/vuln/detail/CVE-2018-16462 · ADVISORY
hackerone.com/reports/405694 · WEB
GitHub Advisory GHSA-9jm3-5835-537m · ADVISORY
nodejs/security-wg · WEB
npmjs.com/advisories/718 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free