curlrequest allows execution of arbitrary commands

CRITICO 9.8CVE-2020-7646 · GHSA-m8xj-5v73-3hh8 · SNYK-JS-CURLREQUEST-568274 · Published 07/05/2020 · updated 17/06/2026

In breve

CVE-2020-7646 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda curlrequest (curlrequest project), curlrequest.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.9%, superiore al 80.2% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
curlrequest curlrequest_project	`≤ 1.0.1`	No fix yet
curlrequest npm	`≤ 1.0.1`	No fix yet

Description

curlrequest through 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands by using a semicolon char in any of the options values.

NVD description

curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input.

References

nvd.nist.gov/vuln/detail/CVE-2020-7646 · ADVISORY
node-js-libs/curlrequest · PACKAGE
node-js-libs/curlrequest · WEB
snyk.io/vuln/SNYK-JS-CURLREQUEST-568274 · WEB
node-js-libs/curlrequest

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free