global-modules-path Command Injection vulnerability

CRITIQUE 9.8CVE-2022-21191 · GHSA-vvj3-85vf-fgmw · Published 13/01/2023 · updated 17/06/2026

En bref

CVE-2022-21191 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant global-modules-path (global-modules-path project), global-modules-path.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.5%, plus élevée que 75.1% des vulnérabilités.
Correctif : mettre à jour vers 3.0.0 ou plus récent.

Package	Affected versions	Patched versions
global-modules-path global-modules-path_project	`< 3.0.0`	`3.0.0`
global-modules-path npm	`< 3.0.0`	`3.0.0`

Description

Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.

NVD description

Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.

References

nvd.nist.gov/vuln/detail/CVE-2022-21191 · ADVISORY
rosen-vladimirov/global-modules-path commit edbdaff · WEB
lorenzomigliorero/npm-node-utils · WEB
rosen-vladimirov/global-modules-path · PACKAGE
rosen-vladimirov/global-modules-path release v3.0.0 · WEB
security.snyk.io/vuln/SNYK-JS-GLOBALMODULESPATH-3167973 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free