Command injection in node-dns-sync

CRITICO 9.8CVE-2020-11079 · GHSA-wh69-wc6q-7888 · Published 28/05/2020 · updated 17/06/2026

In breve

CVE-2020-11079 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda node-dns-sync (node-dns-sync project), dns-sync.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.7%, superiore al 85.9% delle vulnerabilità.
Correzione: aggiornare a 0.2.1 o successiva.

Package	Affected versions	Patched versions
node-dns-sync node-dns-sync_project	`< 0.2.1`	`0.2.1`
dns-sync npm	`≥ 0.1.3, < 0.2.1`	`0.2.1`

Description

dns-sync through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

NVD description

node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.

References

skoranga/node-dns-sync security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2020-11079 · ADVISORY
skoranga/node-dns-sync commit cb10a5a · WEB
skoranga/node-dns-sync · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free